Repository navigation
[Question] Configuring Windows Terminal profile to always launch elevated #632
Description
Hi! Is there a way to configure a profile so that the commandLine it launches always starts with elevated (admin) permissions?
Currently, you can launch the entire application as Administrator, but then every single commandLine runs as Administrator, which is not ideal.
Reacted by Martin Andreas Ullrich, Vincent Fiestada, Corey Smith, Mike MacCana, Shodai Ikebe, Leo Lozes, Pascal Berger, Samuel Ferencik, Daniel, Cory Bowe and 206 more
Activity
zadjii-msft commentedon May 9, 2019
There is not. I don't think we plan on supporting mixed elevated and unelevated tabs, because it's a bit of a security hole.
Yes I know
sudois a thing, but we've had lots of discussions with the security team about the creation of asudofor Windows. The main problem is due to the fact that any unelevated processes can send keystrokes to any other unelevated windows.If you had an elevated commandline running in an unelevated window, an untrusted bad actor could execute an elevation-of-privilege attack by driving the unelevated windows that's running the elevated commandline.
(as a matter of linking related threads, #146)
EDIT (Feb 14 2020)
Okay, so this comment didn't age super well. Originally, there was no plan to support this, since it wouldn't work with the single
HWNDwe had. We're working on designing a solution that might support this in the future, but we can't commit to anything until we're sure that we can come up with an appropriately secure solution, that ensures that a lower privileged process can't drive a higher privilege terminal.pingzing commentedon May 9, 2019
Seems reasonable. I think having something like a combination of #576 (Open as Admin in the jump list), and maybe some kind of hotkey to launch an Admin session of the Terminal would solve most of my pain here.
mdtauk commentedon May 9, 2019
What about having a standard and elevated Terminal open in a single window but separate tabs?
zadjii-msft commentedon May 10, 2019
Martin Anderson (@mdtauk) I think that unfortunately falls under the same category. Since all the tabs are under the same HWND, the root HWND is what would need to be elevated to prevent non-elevated apps from driving the window.
sba923 commentedon May 23, 2019
From a security standpoint (ignoring Windows Terminal's design, single root HWND etc.), how "less secure" is Terminal running mixed-elevation tabs compared to running, say, one elevated PowerShell instance next to one non-elevated one in the current UX? The fact the console apps are hosted in Terminal tabs doesn't make a difference to me...
214 remaining items
MikeChristensen commentedon Sep 1, 2020
DHowett commentedon Sep 1, 2020
If you are having issues with gsudo please report them to Gerardo Grignoli (@gerardog) and not in this thread. Every message on this thread (this one included; sorry!) e-mails hundreds of subscribers.
I am going to lock this thread to further non-maintainer comments, as we are reaching the point where further comments aren’t moving the discussion forward a meaningful amount.
Please file new issues if you have concerns that are not covered here.
Profile auto-elevation, version 3 (#12137)