Chocolatey CLI is incorrectly reporting bad permissions on the HttpCache folder and is not setting them correctly
- Dominant language
- C#
- Stars
- 11.5k
- Forks
- 960
- PR merge metrics
- No merged PRs in 30d
Description
### Checklist
- [x] I confirm there are no unresolved issues reported on the [Chocolatey Status page](https://status.chocolatey.org).
- [x] I have verified this is the correct repository for opening this issue.
- [x] I have verified no other issues exist related to my problem.
- [x] I have verified this is not an issue for a specific package.
- [x] I have verified this issue is not security related.
- [x] I confirm I am using **official**, and **not** unofficial, or modified, Chocolatey products.
### What You Are Seeing?
When the permissions on the `httpcache` folder are changed, Chocolatey CLI shows the following validation warning:
```
System Cache directory is not locked down to administrators. Remove the directory 'C:\ProgramData\ChocolateyHttpCache' to have Chocolatey CLI create it with the proper permissions.
```
When trying to resolve this warning, the user ran an Advanced Deployment Step in Chocolatey Central Management to remove the `httpcache` folder and have Chocolatey CLI recreate it. Chocolatey CLI creates the cache folder, with all local machine users having write access to the folder. This permission change causes the recreated `httpcache` folder to report the same issue of the folder not being locked down to just Administrator user access.
### What is Expected?
Chocolatey should be able to recreate this folder with the correct permissions. Chocolatey should be setting the cache folder's ACL before every run of Chocolatey.
### How Did You Get This To Happen?
1. Install Chocolatey for Business and license it. Note the current permissions on `C:\ProgamData\ChocolateyHttpCache` folder.
2. Go to the `C:\ProgamData\ChocolateyHttpCache` folder and edit the permissions to add `LocalMachine\Users` object to include Write access.
3. Run `choco list` and the validation warning mentioned above, should be shown.
4. Undo the folder permissions change done in Step 2.
5. Run the following [exported Chocolatey Central Management deployment](https://gist.github.com/ryanrichter94/19f56ff66d106144ed76c9b5c69f3dd2) against your test machine.
6. You should notice that the `C:\ProgamData\ChocolateyHttpCache` folder has been re-created. However, `Users` now have `Write` access, and the `CREATOR OWNER` has `Full Control` rights. If you run `choco list` again, you get the same validation warning message.
### System Details
- Operating System: 20348.3091 (Windows Server 2022)
- Windows PowerShell Version: 5.1.20348.2849
- Chocolatey CLI Version: 2.4.2
- Chocolatey Licensed Extension version: 6.3.1
- Chocolatey Agent version: 2.2.2
- Chocolatey License type (Professional / Business / ?): Business
- Terminal/Emulator: Windows PowerShell & Chocolatey Central Management
### Installed Packages
```bash
N/A
```
### Output Log
```bash
[chocolatey.log](https://gist.github.com/ryanrichter94/1cf7cba454db54ec7d48664842e65012)
```
### Additional Context
- [GitLab issue](https://gitlab.com/chocolatey/solutions/support-issues/-/issues/122).
- [Zendesk Ticket](https://chocolatey.zendesk.com/agent/tickets/25162).
Adding the following to the PowerShell of the Advanced Deployment Step in the reproduction steps of this issue will programmatically recreate the cache folder, mirroring the ACLs from `$env:ChocolateyInstall` onto it.
```
if (Test-Path -Path "C:\ProgramData\ChocolateyHttpCache"){
Write-Error "Chocolatey Cache directory still exists!"
} else {
Write-Output "Recreating Chocolatey Cache Directory"
New-Item -Path "C:\ProgramData\" -Name "ChocolateyHttpCache" -ItemType "directory"
Write-Output "Setting correct permissions for Chocolatey Cache Directory"
$ChocolateyACL = Get-Acl -Path $env:ChocolateyInstall
Set-Acl -Path "C:\ProgramData\ChocolateyHttpCache" -AclObject $ChocolateyAcl
}
```
┆Issue is synchronized with this [Clickup task](https://app.clickup.com/t/868m3p4kg) by [Unito](https://www.unito.io)
Contributor guide
Research direction
Start by reproducing the ACL change and folder removal described in the issue, then trace the cache-directory validation and recreation paths exercised by `choco list`. Done means a recreated `C:\ProgramData\ChocolateyHttpCache` has the intended administrator-only permissions and no longer produces the validation warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, powershell
- Domain
- cli, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100