fix: install the device helper from the MSI, owned by the console user

Author: FoxCouncil

.github/workflows/release.yml

@@ -287,6 +287,46 @@ jobs:
             exit 1
           fi
 
+      # ── MSI post-processing ───────────────────────────────────────────────────
+      # Runs AFTER pack (which is where signing happens) and therefore INVALIDATES the MSI's
+      # Authenticode signature - the re-sign below is not optional, it is part of this pair.
+      #
+      # See scripts/msi-elevate-hooks.ps1 for what it changes and why. Short version: vpk emits
+      # the install hook as a deferred IMPERSONATED custom action, so `sc create` inside it runs
+      # on the user's filtered token and the background service is silently never registered.
+      - name: Elevate the MSI install hooks (Windows)
+        if: matrix.rid == 'win-x64'
+        shell: pwsh
+        run: scripts/msi-elevate-hooks.ps1 -MsiPath releases/OrgZ-win.msi
+
+      # Only the MSI is re-signed; every other artifact still carries the signature vpk gave
+      # it. Conditional on the same secret as the rest, so an unsigned build stays a build.
+      - name: Re-sign the patched MSI (Windows)
+        if: ${{ matrix.rid == 'win-x64' && env.HAS_AZURE_SIGNING == 'true' }}
+        uses: azure/artifact-signing-action@v2
+        with:
+          endpoint: ${{ secrets.AZURE_TS_ENDPOINT }}
+          signing-account-name: ${{ secrets.AZURE_TS_ACCOUNT }}
+          certificate-profile-name: ${{ secrets.AZURE_TS_PROFILE }}
+          files-folder: ${{ github.workspace }}/releases
+          files-folder-filter: msi
+          file-digest: SHA256
+          timestamp-rfc3161: http://timestamp.acs.microsoft.com
+          timestamp-digest: SHA256
+
+      # A patched-but-unsigned MSI is worse than either end state: the service works and every
+      # user gets a SmartScreen block. Fail the release here rather than publish that.
+      - name: Verify the MSI signature survived (Windows)
+        if: ${{ matrix.rid == 'win-x64' && env.HAS_AZURE_SIGNING == 'true' }}
+        shell: pwsh
+        run: |
+          $status = (Get-AuthenticodeSignature 'releases/OrgZ-win.msi').Status
+          Write-Host "MSI signature: $status"
+          if ($status -ne 'Valid') {
+            Write-Error "MSI signature is '$status' after patching - the re-sign did not take."
+            exit 1
+          }
+
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:

OrgZ.Tests/ShareHostingTests.cs

@@ -297,7 +297,7 @@ public void Status_line_reads_plainly_in_each_state()
     {
         Assert.Equal("Not sharing", SettingsDialog.DescribeShareState(true, null));
         Assert.Equal("Not sharing", SettingsDialog.DescribeShareState(true, new DeviceHelperClient.ShareState(false, null, 0)));
-        Assert.Equal("Sharing “Fox Library” on port 7391", SettingsDialog.DescribeShareState(true, new DeviceHelperClient.ShareState(true, "Fox Library", 7391)));
+        Assert.Equal("Sharing “Fox Library”", SettingsDialog.DescribeShareState(true, new DeviceHelperClient.ShareState(true, "Fox Library", 7391)));
 
         // A share with no reported name still says something sensible.
         Assert.Contains("This library", SettingsDialog.DescribeShareState(true, new DeviceHelperClient.ShareState(true, "  ", 7391)));

Services/DeviceHelper/DeviceHelperInstaller.cs

@@ -198,12 +198,29 @@ internal static string WindowsFirewallRemoveCommands() =>
                 return null;
             }
 
-            // LocalSystem, LocalService, NetworkService - nobody to own the helper.
+            // LocalSystem, LocalService, NetworkService - nobody is BEHIND this process, so
+            // its own SID is the wrong answer twice over: stamping SYSTEM as the owner locks
+            // out the human who just installed OrgZ, and recording nothing leaves the helper
+            // fail-open to any authenticated caller.
+            //
+            // This is the normal case, not an edge one. The MSI's install hook is deliberately
+            // NoImpersonate (see scripts/msi-elevate-hooks.ps1) because `sc create` needs the
+            // elevated token, which means EVERY machine-wide install arrives here. So ask the
+            // session instead of the token: the person at the console is the person installing.
             if (sid.IsWellKnown(System.Security.Principal.WellKnownSidType.LocalSystemSid)
                 || sid.IsWellKnown(System.Security.Principal.WellKnownSidType.LocalServiceSid)
                 || sid.IsWellKnown(System.Security.Principal.WellKnownSidType.NetworkServiceSid))
             {
-                _log.Information("Install is running as a machine account; the device helper will accept any authenticated caller");
+                var consoleSid = WindowsConsoleUserSid();
+                if (consoleSid is not null)
+                {
+                    _log.Information("Install is running as a machine account; recording the console user {Sid} as the device helper's owner", consoleSid);
+                    return consoleSid;
+                }
+
+                // Unattended, or nobody logged in - an SCCM push, an image build. There is
+                // genuinely no owner to record, so this stays the legacy fail-open case.
+                _log.Warning("Install is running as a machine account with no console user; the device helper will accept any authenticated caller");
                 return null;
             }
 
@@ -216,6 +233,76 @@ internal static string WindowsFirewallRemoveCommands() =>
         }
     }
 
+    /// <summary>
+    /// The SID of the user signed in at the physical console, or null when there isn't one.
+    ///
+    /// Used only when the installer itself is a machine account. WTS is asked for the user
+    /// NAME rather than a token on purpose: <c>WTSQueryUserToken</c> would need SE_TCB_NAME
+    /// and hand back a handle to own and close, while the name translates to a SID through
+    /// plain managed code. LocalSystem can read this without any privilege adjustment.
+    /// </summary>
+    internal static string? WindowsConsoleUserSid()
+    {
+        if (!OperatingSystem.IsWindows())
+        {
+            return null;
+        }
+
+        try
+        {
+            var session = WtsNativeMethods.WTSGetActiveConsoleSessionId();
+
+            // 0xFFFFFFFF means no session is attached to the console - the machine is at the
+            // lock screen with nobody logged in, or this is a headless/RDP-only box.
+            if (session == 0xFFFFFFFF)
+            {
+                return null;
+            }
+
+            var user = WtsQuery(session, WtsNativeMethods.WtsInfoClass.WTSUserName);
+            if (string.IsNullOrWhiteSpace(user))
+            {
+                return null;
+            }
+
+            var domain = WtsQuery(session, WtsNativeMethods.WtsInfoClass.WTSDomainName);
+            var account = string.IsNullOrWhiteSpace(domain) ? user : $@"{domain}\{user}";
+
+            var identifier = (System.Security.Principal.SecurityIdentifier)
+                new System.Security.Principal.NTAccount(account).Translate(typeof(System.Security.Principal.SecurityIdentifier));
+
+            return identifier.Value;
+        }
+        catch (Exception ex)
+        {
+            _log.Debug(ex, "Could not determine the console user's SID");
+            return null;
+        }
+    }
+
+    [System.Runtime.Versioning.SupportedOSPlatform("windows")]
+    private static string? WtsQuery(uint session, WtsNativeMethods.WtsInfoClass info)
+    {
+        var buffer = IntPtr.Zero;
+
+        try
+        {
+            if (!WtsNativeMethods.WTSQuerySessionInformationW(IntPtr.Zero, session, info, out buffer, out _))
+            {
+                return null;
+            }
+
+            return System.Runtime.InteropServices.Marshal.PtrToStringUni(buffer);
+        }
+        finally
+        {
+            if (buffer != IntPtr.Zero)
+            {
+                WtsNativeMethods.WTSFreeMemory(buffer);
+            }
+        }
+    }
+
     /// <summary>
     /// Records the owner SID in the service's own environment. A Windows service has no
     /// equivalent of launchd's EnvironmentVariables or systemd's Environment=, but the SCM

Services/DeviceHelper/WtsNativeMethods.cs

@@ -0,0 +1,47 @@
+// Copyright (c) 2026 FoxCouncil (https://github.com/FoxCouncil/OrgZ)
+
+using System.Runtime.InteropServices;
+using System.Runtime.Versioning;
+
+namespace OrgZ.Services.DeviceHelper;
+
+/// <summary>
+/// The two Terminal Services calls needed to answer "who is sitting at this machine".
+///
+/// Only reached when OrgZ is running as LocalSystem during the MSI install hook, where
+/// <see cref="System.Security.Principal.WindowsIdentity.GetCurrent"/> describes the machine
+/// rather than the person - see <see cref="DeviceHelperInstaller.WindowsConsoleUserSid"/>.
+/// </summary>
+[SupportedOSPlatform("windows")]
+internal static partial class WtsNativeMethods
+{
+    internal enum WtsInfoClass
+    {
+        WTSUserName = 5,
+        WTSDomainName = 7,
+    }
+
+    /// <summary>
+    /// The session currently attached to the physical console, or 0xFFFFFFFF when none is.
+    /// Fast User Switching moves this, which is the point: it names the session in front of
+    /// the screen right now, not the first one that logged in.
+    /// </summary>
+    [LibraryImport("kernel32.dll")]
+    internal static partial uint WTSGetActiveConsoleSessionId();
+
+    /// <summary>
+    /// <c>WTS_CURRENT_SERVER_HANDLE</c> is IntPtr.Zero - the local machine. The returned
+    /// buffer belongs to WTS and must go back through <see cref="WTSFreeMemory"/>.
+    /// </summary>
+    [LibraryImport("wtsapi32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool WTSQuerySessionInformationW(
+        IntPtr server,
+        uint sessionId,
+        WtsInfoClass infoClass,
+        out IntPtr buffer,
+        out uint bytesReturned);
+
+    [LibraryImport("wtsapi32.dll")]
+    internal static partial void WTSFreeMemory(IntPtr memory);
+}

Views/SettingsDialog.axaml.cs

@@ -86,8 +86,11 @@ private void LoadSettings()
 
         // Services
         ShareNameInput.Text = Settings.Get("OrgZ.Services.Sharing.Name", $"{Environment.MachineName} Library");
+        // Seeded from settings so the box is not blank for the length of a service probe; the
+        // probe below corrects it from what the service is ACTUALLY doing. Not refreshed here
+        // as well - RefreshServiceStatusAsync now ends by re-reading the share, and firing both
+        // would race two probes at the same checkbox on every open.
         ShareEnabledCheck.IsChecked = Settings.Get("OrgZ.Services.Sharing.Enabled", false);
-        _ = RefreshShareStatusAsync();
 
         // No "Disc burning" row: a burn always survives the GUI (the service or the elevated
         // helper process owns the write), and stopping one mid-write would only ruin the disc.
@@ -636,7 +639,7 @@ internal static string DescribeShareState(bool serviceAvailable, Services.Device
         }
 
         var name = string.IsNullOrWhiteSpace(state.Name) ? "This library" : state.Name;
-        return $"Sharing “{name}” on port {state.Port}";
+        return $"Sharing “{name}”";
     }
 
     private async Task RefreshShareStatusAsync()
@@ -745,6 +748,14 @@ private async Task RefreshServiceStatusAsync()
         }
 
         SetServiceButtons(buttons);
+
+        // The share card reads the SAME service this method just changed the state of, so it
+        // has to be re-read here rather than only when the dialog opens. Without this, starting
+        // or stopping the service left the sharing checkbox showing whatever was true when the
+        // dialog was constructed - disabled after a start that had just made it available,
+        // still ticked after a stop that had already torn the share down - and the only way to
+        // correct it was to close and reopen the app.
+        await RefreshShareStatusAsync();
     }
 
     private void SetServiceButtons(ServiceButtons buttons)