chocolatey / chocolatey/choco

Chocolatey CLI is incorrectly reporting bad permissions on the HttpCache folder and is not setting them correctly

Open
#3,645 2 comments 0 reactions 0 assignees View on GitHub
0 - Backlog Bug ClickUp - Interrupt Priority - High Security
Dominant language
C#
Stars
11.5k
Forks
960
PR merge metrics
No merged PRs in 30d

Description

### Checklist

- [x] I confirm there are no unresolved issues reported on the [Chocolatey Status page](https://status.chocolatey.org).
- [x] I have verified this is the correct repository for opening this issue.
- [x] I have verified no other issues exist related to my problem.
- [x] I have verified this is not an issue for a specific package.
- [x] I have verified this issue is not security related.
- [x] I confirm I am using **official**, and **not** unofficial, or modified, Chocolatey products.

### What You Are Seeing?

When the permissions on the `httpcache` folder are changed, Chocolatey CLI shows the following validation warning:

```
System Cache directory is not locked down to administrators. Remove the directory 'C:\ProgramData\ChocolateyHttpCache' to have Chocolatey CLI create it with the proper permissions.
```

When trying to resolve this warning, the user ran an Advanced Deployment Step in Chocolatey Central Management to remove the `httpcache` folder and have Chocolatey CLI recreate it. Chocolatey CLI creates the cache folder, with all local machine users having write access to the folder. This permission change causes the recreated `httpcache` folder to report the same issue of the folder not being locked down to just Administrator user access.

### What is Expected?

Chocolatey should be able to recreate this folder with the correct permissions. Chocolatey should be setting the cache folder's ACL before every run of Chocolatey.

### How Did You Get This To Happen?

1. Install Chocolatey for Business and license it. Note the current permissions on `C:\ProgamData\ChocolateyHttpCache` folder.
2. Go to the `C:\ProgamData\ChocolateyHttpCache` folder and edit the permissions to add `LocalMachine\Users` object to include Write access.
3. Run `choco list` and the validation warning mentioned above, should be shown.
4. Undo the folder permissions change done in Step 2.
5. Run the following [exported Chocolatey Central Management deployment](https://gist.github.com/ryanrichter94/19f56ff66d106144ed76c9b5c69f3dd2) against your test machine.
6. You should notice that the `C:\ProgamData\ChocolateyHttpCache` folder has been re-created. However, `Users` now have `Write` access, and the `CREATOR OWNER` has `Full Control` rights. If you run `choco list` again, you get the same validation warning message.

### System Details

- Operating System: 20348.3091 (Windows Server 2022)
- Windows PowerShell Version: 5.1.20348.2849
- Chocolatey CLI Version: 2.4.2
- Chocolatey Licensed Extension version: 6.3.1
- Chocolatey Agent version: 2.2.2
- Chocolatey License type (Professional / Business / ?): Business
- Terminal/Emulator: Windows PowerShell & Chocolatey Central Management

### Installed Packages

```bash
N/A
```

### Output Log

```bash
[chocolatey.log](https://gist.github.com/ryanrichter94/1cf7cba454db54ec7d48664842e65012)
```

### Additional Context

- [GitLab issue](https://gitlab.com/chocolatey/solutions/support-issues/-/issues/122).
- [Zendesk Ticket](https://chocolatey.zendesk.com/agent/tickets/25162).

Adding the following to the PowerShell of the Advanced Deployment Step in the reproduction steps of this issue will programmatically recreate the cache folder, mirroring the ACLs from `$env:ChocolateyInstall` onto it.

```
if (Test-Path -Path "C:\ProgramData\ChocolateyHttpCache"){
Write-Error "Chocolatey Cache directory still exists!"
} else {
Write-Output "Recreating Chocolatey Cache Directory"
New-Item -Path "C:\ProgramData\" -Name "ChocolateyHttpCache" -ItemType "directory"

Write-Output "Setting correct permissions for Chocolatey Cache Directory"
$ChocolateyACL = Get-Acl -Path $env:ChocolateyInstall
Set-Acl -Path "C:\ProgramData\ChocolateyHttpCache" -AclObject $ChocolateyAcl
}
```

┆Issue is synchronized with this [Clickup task](https://app.clickup.com/t/868m3p4kg) by [Unito](https://www.unito.io)

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the ACL change and folder removal described in the issue, then trace the cache-directory validation and recreation paths exercised by `choco list`. Done means a recreated `C:\ProgramData\ChocolateyHttpCache` has the intended administrator-only permissions and no longer produces the validation warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, powershell
Domain
cli, operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.