EXE installers: inherit permissions from $INSTDIR for all-users installations

[marcoesters]

Description

For all-user installations, the permissions of the installation directory are changed manually to remove write access for authenticated, domain, and built-in users, and to add read and execute rights for domain and built-in users. This assumes that permissions applied to the installation directories are inherited by all files and subdirectories.

If a file has the SDDL_PROTECTED flag set (see Security Descriptors), these permissions are no inherited and thus not changed. The result is that users who are not part of the Administrators group(s) cannot use these files.

One example where this flag is set is the exe entry points created by _conda.exe: conda-standalone creates a hard link from the entry point in the extracted temporary directory to the installation directory. Windows automatically sets the SDDL_PROTECTED flag in that case and the permissions are not changed at the end of the installation.

The solution is to enable inheritance for all files and directories inside $INSTDIR while still protecting $INSTDIR itself. This is done by a call to icacls because it is much faster than calling AccessControl::EnableFileInheritance on every file (local tests with only jupyter show a difference of 30 seconds).

The added tests fail for the Miniforge example without this addition, as expected.

Closes #828.

Checklist - did you ...

• Add a file to the news directory (using the template) for the next release's release notes?
• Add / update necessary tests?
• Add / update outdated documentation?

[marcoesters]

I had to add the /C flag to continue on error. When I logged into the runner, icacls wasn't able to change the inheritance of one particular file in one of the Python packages, probably because of a broken hard link. So, changing those permissions is essentially a "best effort" for now.

[jaimergp]

This is a super useful test that nonetheless might feel foreign when compared to the other tests in this module. Can you add a docstring explaining what we are testing here and why? It's obvious now in the context of this PR, but it might not be in the future when this all of a sudden fails in the future for whatever reason.

[marcoesters]

That's a good call. I added a detailed doc string to the function that also talks about the limitations of this test. It only tests that permissions are correctly applied. A more complete test would go through all permissions attached to each file and ensures that write permissions are unset for users who are not part of the local administrator group. However, this isn't part of the installer code either.

[moorepants]

I built our installer with this branch if you'd like to test: https://github.com/moorepants/anaconda-dee-config/actions/runs/15697333735

[moorepants]

🎉 Thanks for this fix!