Signed installer gets binaries auto white-listed

[mfriedrich]

Hello,

i added a certificate to Solidcore for authorized execution, but it has not the updater privilege. Files with this certificate execute without the need of whit-listing.

An installer package, its uninstaller and some of the binaries inside have this certificate. 

But, the files installed by this installer (which is not an updater) get whitelisted automatically at install time. As a result the uninstaller fails to remove the files afterwards, because it is not an updater.

Aditionally all files in the installer are white-listed, not just those with a valid signature .

How can i turn off this auto white-listing? This behaviour is documented only for updaters, so, is this a bug in Solidcore 7.0.1?

[gnautiya · Accepted solution]

You must be observing this because your installer is categorised under "Computed tag=Installer in our inventory.

Files which get this tag, and if its certificate is authorized, we mark it updater as well.

Can be checked under "sadmin ls -lax < file path till its name >.

You can try other option to authorize the file execution, e.g. mark its checksum as authorized.

Regards

[mfriedrich]

It prints:
updater="No"
computed_tags="Installer"

I cannot use checksums, they change each time a new version of this installer is released.

Is there a computed_tags="Uninstaller" also?

How do i make the uninstalled being detected as uninstaller? Currently it is signed by the same certificate but fails to remove the installed files.

[mfriedrich]

How do i turn off Installer computed_tags? It undermines the secuity of the system.

[mfriedrich]

How do i turn off installers (computed_tags) being promoted to updaters?

Or:

How do i make uninstallers being detected as Uninstallers and also promoted to updaters?

Without either of those the behaviour is inconsistent / broken. Software can get installed but not uninstalled.

[BenEllis]

You cannot turn off installers/uninstaller tag. These are binaries identified as installers, because of a header or extension.

Can you tell me if the feature - Pkg-ctrl allow uninstall is enabled? Did you add the installer/uninstaller to your policy? If you do it should be able to install/uninstall. 

You can disable pkg-ctrl and nothing will install/uninstall but i dont recommend that because even windows updates would fail. Do you have a case in support ?

[mfriedrich]

Yes, allow uninstall is enabled.

The installer is an Inno Setup installer, which creates the uninstaller in the install folder with name unins000.exe unins001.exe ...

[mfriedrich]

This is still part of my evaluation of the product if it would work on our machines (running the write-filter), so no, i do not have the ablity to open case tickets.

[BenEllis]

Have you added the installer to the installer tab of Solidcore Rules? Then have you added the installer to a rule group? Then did you add the installer to a policy?

[mfriedrich]

No EPO server. This is a standalone/unmanaged SolidCore installation.

The installers certificate is added to the list of allowed executables with "sadmin cert add Authorized_Application.crt". The certificate is not added as an updater. The uninstaller executable that is installed by this installer, is signed with the same certificate.