Questions regarding Windows buildbots

Hello! I'm working on a patch for issue bugs.python.org/issue8579 (Add missing tests for FlushKey, LoadKey, and SaveKey in winreg). This issue requires the SeBackupPrivilege in order to use LoadKey and SaveKey. While acquiring the privilege isn't very complicated using ctypes, it fails with ERROR_NOT_ALL_ASSIGNED (1300) when the user has Administrative privileges, but it's not an Administrator, problem which can be eluded by running the script with elevated privileges. This leads me to a couple of questions: - should a Windows test be skipped if it can't acquire a certain privilege? - If we can acquire the privilege by elevating our process, does the Windows buildbots have UAC enabled and if so, how's the notification setting configured? For instance, elevating a process will trigger a new UAC window with the message "Do you want to allow the following program from an unknown publisher to make changes to this computer?" on the recommended configuration, but this doesn't happen when the configuration is set to "Never notify". Thank you.

On Mon, May 12, 2014 at 5:16 PM, Claudiu Popa <pcmanticore@gmail.com> wrote:
Hello!
I'm working on a patch for issue bugs.python.org/issue8579 (Add missing tests for FlushKey, LoadKey, and SaveKey in winreg). This issue requires the SeBackupPrivilege in order to use LoadKey and SaveKey. While acquiring the privilege isn't very complicated using ctypes, it fails with ERROR_NOT_ALL_ASSIGNED (1300) when the user has Administrative privileges, but it's not an Administrator, problem which can be eluded by running the script with elevated privileges. This leads me to a couple of questions:
- should a Windows test be skipped if it can't acquire a certain privilege?
Yes. Check out any of the os.symlink tests - they're currently skipped when the symlink privilege isn't held.
- If we can acquire the privilege by elevating our process, does the Windows buildbots have UAC enabled and if so, how's the notification setting configured? For instance, elevating a process will trigger a new UAC window with the message "Do you want to allow the following program from an unknown publisher to make changes to this computer?" on the recommended configuration, but this doesn't happen when the configuration is set to "Never notify".
That probably depends on how each machine is setup. If they happen to get blocked on any individual slave, we'll just have to ask the owner to change that setting. Currently there are no Windows build slaves running as administrator. I used to have one but the machine died and I never replaced it. I also said a few months ago that I would get one setup again, but that hasn't happened yet. I can get a new machine up and running but probably not until next week as I'm at a conference.

Brian Curtin <brian@python.org> writes:
On Mon, May 12, 2014 at 5:16 PM, Claudiu Popa <pcmanticore@gmail.com> wrote: (...)
- If we can acquire the privilege by elevating our process, does the Windows buildbots have UAC enabled and if so, how's the notification setting configured? For instance, elevating a process will trigger a new UAC window with the message "Do you want to allow the following program from an unknown publisher to make changes to this computer?" on the recommended configuration, but this doesn't happen when the configuration is set to "Never notify".
That probably depends on how each machine is setup. If they happen to get blocked on any individual slave, we'll just have to ask the owner to change that setting.
For reference, my Windows 7 slave (bolen-windows7) is currently running with stock UAC settings, so I believe would prompt in such a scenario. The slave does run all builds with Windows error dialogs disabled, but I doubt that covers UAC. It's certainly no problem to disable the UAC prompting if it would help or if that becomes a more useful setting for the buildbot environment. It probably fits better with my existing model of disabling other sorts of error popups anyway, but just isn't something we've run up against yet in the build process.
Currently there are no Windows build slaves running as administrator. I used to have one but the machine died and I never replaced it. I also said a few months ago that I would get one setup again, but that hasn't happened yet. I can get a new machine up and running but probably not until next week as I'm at a conference.
Yes - my slaves (XP and Win7) are running under administrative accounts, but not the literal Administrator account. Though I'm guessing this topic may be moot for the XP slave as it doesn't have UAC. Claudiu, if you've got any specific test code you'd like to have executed on either of my slaves to see how it behaves, I'd be happy to help. Just contact me directly. -- David
participants (3)
-
Brian Curtin
-
Claudiu Popa
-
David Bolen