如何使用用户权限而不是活动权限启动程序 [英] How to launch program with user permissions instead of active permissions

问题描述

我有一个运行并显示任务栏图标的C#应用​​程序.我有一个适用于我的纸盘应用程序的安装程序，该安装程序会在安装后启动该应用程序.安装程序需要管理员权限，而托盘图标必须以正常权限运行.我的安装程序当前打破了这一点-启动已安装的纸盘应用程序时，它会从安装程序进程继承管理权限.

I have a C# application which runs and displays a tray icon. I have an installer for my tray application which launches the application after installation. The installer requires admin permissions whereas the tray icon must be run with normal permissions. My installer currently breaks this - when the installed tray application is launched it inherits admin permissions from the installer process.

作为安装程序的一部分，我正在启动C#应用程序以执行一些自定义工作.这个小应用程序当前通过调用以下命令启动任务栏应用程序:

As part of my installer I am launching a C# application to perform some custom work. This small application currently launches the tray application by calling:

Process.Start(@"path/to/my/tray/app.exe"); 

是否有任何方法可以使用当前用户的权限而不是授予安装程序的提升的权限来调用任务栏应用程序?

Is there any way to invoke the tray app with the current user's permissions rather than the elevated permissions given to the installer?

我听说推荐的方法是在安装程序周围安装一个包装EXE，启动安装程序，然后启动已安装的程序.我想避免这种情况.

I have heard that the recommended way to do this is to have a wrapper EXE around the installer which launches the installer then launches the installed program. I would like to avoid this if possible.

我正在使用WiX来构建MSI安装程序，因此我也接受直接在WiX/MSI上运行的解决方案.

I am using WiX to build an MSI installer so I would also accept solutions which work directly from WiX/MSI.

推荐答案

很好的问题.我发现表面上工作的答案有些混乱.最优雅的整体是EXE包装器.

Very good question. The answers I found that ostensibly work are all a bit messy; the most elegant overall is the EXE wrapper.

请查看此文章: http://www.codeproject. com/KB/vista-security/RunNonElevated.aspx .它描述了一种方法，通过该方法，您可以获取到其中一个非高架运行的Shell窗口的本机挂钩，并要求Shell为您启动代码. C#中的本机挂钩需要非常高的CAS权限；要获得这些权限，必须对安装程序进行强命名和签名，并且代码必须使用SecurityPermissionFlag.UnmanagedCode要求或声明SecurityPermission.

Have a look at this article: http://www.codeproject.com/KB/vista-security/RunNonElevated.aspx. It describes a method by which you can obtain a native hook to one of the shell windows, which run non-elevated, and ask the shell to start your code for you. Native hooks in C# require very high CAS permissions; to get these permissions, your installer must be strongly named and signed, and the code must demand or assert SecurityPermission with SecurityPermissionFlag.UnmanagedCode.

.NET Framework的ProcessStartInfo类还包含UseShellExecute布尔属性，该属性在设置时会告诉Process.Start()将此调用给予外壳，而不是直接从当前应用程序域启动进程.我不知道这样做是否可以满足您的需要，但是尝试起来绝对容易得多.您只需要使用Process.Start()的ProcessStartInfo重载，并使用声明的ProcessStartInfo设置标志即可.

The ProcessStartInfo class of the .NET Framework also contains a UseShellExecute Boolean property that, when set, tells Process.Start() to give this call to the shell rather than starting the process directly from the current application domain. I don't know if this will do that you need, but it's definitely much easier to try; you just use the ProcessStartInfo overload of Process.Start(), with a declared ProcessStartInfo having the flag set.

请记住，您不能告诉外壳程序以当前登录用户以外的用户身份启动EXE(不得在ProcessStartInfo上设置UserName和Password).您还必须使用WorkingDirectory属性指定EXE的路径.

Remember that you cannot tell the shell to start an EXE as a user other than the currently logged-in user (UserName and Password must not be set on the ProcessStartInfo). You must also specify the path to the EXE using the WorkingDirectory property.

这篇关于如何使用用户权限而不是活动权限启动程序的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！