PowerShell · TravisEz13 · Sep 18, 2018 · Aug 29, 2018 · Aug 29, 2018 · Aug 30, 2018
@@ -14,11 +14,31 @@ phases:
   queue:
     name: Hosted Ubuntu 1604
   steps:
+  - powershell: |
+      Get-Process
+    displayName: Capture Processes
+    condition: succeededOrFailed()
+
   - powershell: |
       Get-ChildItem -Path env:
     displayName: Capture environment
     condition: succeededOrFailed()
 
+  - powershell: |
+      # sometimes the file is locked and we must wait or things will fail
+      $filePath = '/var/lib/dpkg/lock'
+      $lockList = sudo lsof '/var/lib/dpkg/lock'
+      while($lockList)
+      {
+        Write-Verbose "waiting..." -verbose
+        Write-Verbose ($lockList -join "`n") -verbose
+        Start-Sleep -Second 30
+        $lockList = sudo lsof $filePath
+      }
+      exit 0
+    displayName: Wait for /var/lib/dpkg/lock
+    condition: succeededOrFailed()
+
   - powershell:  Write-Host "##vso[build.updatebuildnumber]$env:BUILD_SOURCEBRANCHNAME-$env:BUILD_SOURCEVERSION-$((get-date).ToString("yyyyMMddhhmmss"))"
     displayName: Set Build Name for Non-PR
     condition: ne(variables['Build.Reason'], 'PullRequest')
@@ -35,12 +55,6 @@ phases:
     displayName: SubModule Init
     condition: succeededOrFailed()
 
-  - powershell: |
-      sudo apt-get update
-      sudo apt-get install -y --no-install-recommends less
-    displayName: Install less
-    condition: succeededOrFailed()
-
   - powershell: |
       tools/travis.ps1 -Stage Bootstrap
     displayName: Bootstrap

@@ -1089,6 +1089,15 @@ function Start-PSPester {
     # we need to do few checks and if user didn't provide $ExcludeTag explicitly, we should alternate the default
     if ($Unelevate)
     {
+        $Script:psNonAdminCred = $null
+        $nonAdminCredsPath = "$env:TEMP\PsNonAdminCred.xml"
+
+        # AppVeyor doesn't work well with a non-admin user
+        if ((Test-Path -Path $nonAdminCredsPath) -and !$env:AppVeyor)
+        {
+            try { $Script:psNonAdminCred = Import-Clixml -Path $nonAdminCredsPath } catch { }
+        }
+
         if (-not $Environment.IsWindows)
         {
             throw '-Unelevate is currently not supported on non-Windows platforms'
@@ -1150,7 +1159,17 @@ function Start-PSPester {
 
     if ($Unelevate)
     {
-        $outputBufferFilePath = [System.IO.Path]::GetTempFileName()
+        if($Script:psNonAdminCred)
+        {
+            $outputBufferFolder = New-SubFolderWithPermissions -Path $env:SystemDrive -ChildPath ([System.IO.Path]::GetRandomFileName())
+            $outputBufferFilePath = Join-Path -Path $outputBufferFolder -ChildPath ([System.IO.Path]::GetRandomFileName())
+            $null = New-Item -ItemType File -Path $outputBufferFilePath
+            $null = icacls $outputBufferFilePath /grant Everyone:F
+        }
+        else
+        {
+            $outputBufferFilePath = [System.IO.Path]::GetTempFileName()
+        }
     }
 
     $command += "Invoke-Pester "
@@ -1286,6 +1305,7 @@ function Start-PSPester {
                 }
                 if ($lines | Where-Object { $_ -eq '__UNELEVATED_TESTS_THE_END__'})
                 {
+                    Write-Log "Got end of unelevated tests"
                     break
                 }
 
@@ -1346,7 +1366,7 @@ function Start-PSPester {
         $env:POWERSHELL_TELEMETRY_OPTOUT = $originalTelemetry
         if ($Unelevate)
         {
-            Remove-Item $outputBufferFilePath
+            Remove-Item $outputBufferFilePath -ErrorAction SilentlyContinue
         }
     }
 
@@ -1399,7 +1419,72 @@ function script:Start-UnelevatedProcess
         throw "Start-UnelevatedProcess is currently not supported on non-Windows platforms"
     }
 
-    runas.exe /trustlevel:0x20000 "$process $arguments"
+    # the current consumer of this function does not depend on
+    # this function waiting on the process to complete
+    if ($Script:psNonAdminCred)
+    {
+        Write-Log "Running with non-admin user..."
+        $psi = [System.Diagnostics.ProcessStartInfo]::new($process)
+        $psi.Arguments = "$arguments"
+        $netCred = $Script:psNonAdminCred.GetNetworkCredential()
+        $psi.Password = $Script:psNonAdminCred.Password
+        $psi.UserName = $netCred.UserName
+        $psi.Domain = $netCred.Domain
+        # Shell execute must be false for both the password and environment
+        $psi.UseShellExecute = $false
+        $psi.WorkingDirectory = (Get-Location).ProviderPath
+        # Set variables we want to carry over to the new process
+        Get-ChildItem env:SYSTEM_*, env:BUILD_*, env:TF_*, env:AGENT_* | ForEach-Object {
+            $psi.EnvironmentVariables[$_.Name]=$_.Value
+        }
+
+        # Setup directories non-admin user can use
+        $nonAdminRoot = New-SubFolderWithPermissions -Path $env:TEMP -ChildPath ([System.IO.Path]::GetRandomFileName())
+        $nonAdminProfile = New-SubFolderWithPermissions -Path $nonAdminRoot -ChildPath 'profile'
+        $nonAdminTemp = New-SubFolderWithPermissions -Path $nonAdminRoot -ChildPath 'temp'
+        $nonAdminAppData = New-SubFolderWithPermissions -Path $nonAdminRoot -ChildPath 'AppData'
+        $nonAdminAppDataLocal = New-SubFolderWithPermissions -Path $nonAdminAppData -ChildPath 'Local'
+        $nonAdminAppDataRemote = New-SubFolderWithPermissions -Path $nonAdminAppData -ChildPath 'Remote'
+        $psi.EnvironmentVariables['TEMP']=$nonAdminTemp
+        $psi.EnvironmentVariables['LOCALAPPDATA']=$nonAdminAppDataLocal
+        $psi.EnvironmentVariables['APPDATA']=$nonAdminAppDataRemote
+        $psi.EnvironmentVariables['USERPROFILE']=$nonAdminProfile
+
+        [System.Diagnostics.Process]::Start($psi)
+
+        #Start-Process -FilePath $process -ArgumentList $arguments -Credential $Script:psNonAdminCred
+    }
+    else
+    {
+        Write-Log "Using runas to launch unelevated..."
+        runas.exe /trustlevel:0x20000 "$process $arguments"
+    }
+}
+
+function New-SubFolderWithPermissions
+{
+    param(
+        [string]
+        $Path,
+        [string]
+        $ChildPath,
+        [string]
+        $Permissions = 'Everyone:F'
+    )
+
+    Write-Verbose "New-SubFolderWithPermissions - Path: '$Path', ChildPath: '$ChildPath'" -Verbose
+    $newFolderPath = Join-Path -Path $Path -ChildPath $ChildPath
+
+    Write-Verbose "New-SubFolderWithPermissions - newFolderPath: '$newFolderPath'" -Verbose
+    $null = New-Item -ItemType Directory -Path $newFolderPath
+
+    Write-Verbose "New-SubFolderWithPermissions - granting permssions: '$Permissions'" -Verbose
+    $acl = Get-Acl -Path $newFolderPath
+    $accessrule = New-Object System.Security.AccessControl.FileSystemAccessRule ('Everyone', 'FullControl', 'ContainerInherit, ObjectInherit', 'InheritOnly', 'Allow')
+    $acl.SetAccessRule($accessrule)
+    Set-Acl -Path $newFolderPath -AclObject $acl
+    #$null = icacls $newFolderPath /grant $Permissions
+    return $newFolderPath
 }
 
 function Show-PSPesterError