I created a pretty simple application + installer, which relies on including Firefox portable with it.
Originally, during installation I was extracting a Firefox portable zip file to c:\programdata\<company>\<prod>\firefox and ran into a weird error when trying to launch it. Took me a while, but I figured out the reason for this was because all the files in that firefox subdir had an adjusted security setting. They all had "Integrity Level" set to "low mandatory level". The exact same folder contents without that security setting causes Firefox to work fine.
I couldn't find any documentation online about Windows automatically making c:\programdata\ files use Integrity Level: low mandatory level. I guessed maybe Windows when doing creates/writes for files directly under c:\programdata\ adds this automatically? I did verify my install helper exe that runs with my MSI, which does the unzipping, is running with elevated privilege's (User: NT AUTHORITY\SYSTEM).
I thought I figured out a fix for this. Instead of unzipping Firefox directly to under c:\programdata, I created a folder under my temporary files directory, extract there, then issue a Win32 MoveFileEx() call to move that directory to underneath c:\programdata\. This seemed to work, and I thought this was the answer and was done. Just recently, though, I got a new PC, tried running my installer on this new PC, and I ran into that same error message again when my app tried to launch Firefox. I checked under c:\programdata\ and the Firefox exe had that "low mandatory level" security set on it.
Also, I tried uninstalling my app, reinstalling, and now it appears to be working (no "low mandatory level" permission added yet). For how long, though, time will tell.
Does anyone know what the deal is with this, and what the best solution is?
I wondered about running cacls.exe / icacls.exe each time my app launches, to reset file security settings to normal. My app is made to run at user login and stay running, though, so I don't know the risk of Windows maybe changing the security settings again after my app starts. In theory, if I had to, I guess I could run the cacls.exe / icacls.exe every time before it attempts to launch Firefox, but that sounds ugly.
