Changes between Version 7 and Version 8 of ClientSetupWinSix
- Timestamp:
- Jan 11, 2008, 1:38:25 PM (16 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
ClientSetupWinSix
v7 v8 14 14 Changes to BOINC version 6 include: 15 15 16 * Account-based sandboxing 16 * Choice of multi-user protection policy. 17 * Optional account-based sandboxing 17 18 * Separate data and executable directories 18 19 * Simplified installer experience 20 21 === Multi-user protection policy === 22 23 The installer offers two protection modes: 24 25 * '''Public''': all users on the host can control BOINC (i.e. attach/detach projects) using the BOINC Manager. 26 * '''Private''': Only the user who installed BOINC or an administrator can control BOINC. Users can be allowed to control by adding them to a 'boinc_users' group. When other users run the BOINC Manager, they'll get a dialog saying to contact the administrator to add them to the 'boinc_users' group. 19 27 20 28 == Account-based sandboxing == … … 22 30 The installer offers two security modes: 23 31 24 * '''Secure''': the BOINC client and applications run under unprivileged accounts. The c ore client runs as a service. ??? why are these linked?32 * '''Secure''': the BOINC client and applications run under unprivileged accounts. The client runs as a service (this is necessary because Windows lacks a "setuid" feature; running a program as a different user requires storing the password of that user, which we don't want to do). 25 33 26 * '''Graphics compatible''': same as the single-user installation of v5; the core client and all applications run in the same security context as the user who logged into the system. This allows users to see graphics from older as well as newer science applications, or projects with long running tasks which won't complete for a while.34 * '''Graphics compatible''': the client and applications run under the account the user who logged into the system. This allows users to see graphics from older as well as newer science applications, or projects with long running tasks which won't complete for a while. The client does not run as service (otherwise graphics wouldn't work). This option is available only with the Private protection policy. 27 35 28 36 The advantages of Secure mode are: … … 31 39 * By default non-administrative accounts cannot create globally named shared memory segments, therefore keyboard and mouse activity could not be monitored without setting up an account with that additional user right. 32 40 33 === Multi-user protection policy === 41 In secure mode, the BOINC client is started at system boot time by the service control manager. 42 For a Public installation, the BOINC Manager is launched at login for all users 43 (this simplifies the installer; it can be disabled by removing the shortcut from All Users / Microsoft / Start Menu / Startup). 44 For a Private installation, the Manager is started at login only for the installing user. 34 45 35 The installer offers two protection modes: 36 * All users on the host can control BOINC (i.e. attach/detach projects) using the BOINC Manager. 37 * Only the user who installed BOINC or an administrator can control BOINC. Users can be allowed to control by adding them to a 'boinc_users' group. When other users run the BOINC Manager, they'll get a dialog saying to contact the administrator to add them to the 'boinc_users' group. 46 In graphics compatible mode, the BOINC Manager is launched when the installing user logs on (a shortcut to it is in the user's Startup folder). The Manager in turn launches the BOINC client. 38 47 39 == Executable/Data Separation==48 == Separation of executable and data files == 40 49 41 50 Previous versions of BOINC on Windows stored the data files and executable files 42 51 in the same directory. 43 This created problems on Vista with the UAC feature. 52 This created problems on Vista; 53 writing to C:\Program Files\BOINC is by default prohibited in Vista, 54 allowing BOINC to be run only from user accounts with Administrator privileges. 55 Furthermore, Windows Defender blocks BOINC Manager at startup, 56 requiring the user to dismiss a balloon. 44 57 45 58 Having a separate data directory also allows you to use a new hard drive or network drive for data, 46 without moving the executables. This makes BOINC installations more portable, and simplifies backing up BOINC. 59 without moving the executables. 60 This makes BOINC installations more portable, 61 and simplifies backing up BOINC. 47 62 48 63 The V6 installer create a new data directory and migrates existing data files to the new data directory.