[R] Windows Vista issues

[Prof Brian Ripley]

It seemed FUD [*] has been prevailing here and elsewhere on Vista security 
features.

I asked our sysadmins to set up a Vista box for me on which I have access 
to all levels of accounts.  Many of the issues I found were covered by 
earlier answers and all in the upcoming rw-FAQ (currently available at 
http://www.stats.ox.ac.uk/pub/R/rw-FAQ.html and in the 2.5.0 pre-releases) 
but a quick reprise may help.

Most of my testing was of 2.5.0 beta, but I did some quick tests of 2.4.1.


1) The R installer and uninstaller are from an 'unidentified publisher' 
and you may have to agree that you trust them.  This is a problem of the 
Inno Setup installer kit we use.  An ultra-cautious sysadmin could 
configure Vista to stop you installing via such a program.


2) Permission problems:

If you install R as an ordinary user (into your own file space) you should 
see no permissions problems.  (There would have been problems, including 
under XP, with some recent daily binary builds as the installer kit had 
changed one of its defaults to disallow non-administrator installs, but 
these have been fixed.)

I also encountered no problems installing R under the Administrator 
account (normally hidden) and installing packages under the same account.

Things are more complicated if you use an account which is in the local 
administrator group (but is not Administrator itself).  Such accounts are 
no longer (by default) equivalent to Administrator, and run programs as 
ordinary user accounts. They need to 'Run as Administrator' to do things 
in the system area such as C:\Program Files.  You will be asked if you 
want to run as administrator if you try to install software such as R, but 
you will not be asked if you try to install packages in the main R library 
(since asking is something that applies to a program, not part of a 
particular session).  One simple solution is to elevate your credentials 
when running an R session to install packages in the same way that you 
needed to when installing R.  (Unix and MacOS X users will recognize a 
somewhat automated reincarnation of 'sudo'.)

It looks like the best practice will be to change the (full) ownership of 
the R installation to the account used to install it, something which 
would be standard practice in the Unix world.  Also, we are encouraging 
people as from 2.5.0 to install packages into a site or personal library 
where these permission issues should not arise (except when updating 
recommended packages).


3) The most worrying problem is that Vista is reporting quite incorrectly 
file permissions through the POSIX interfaces used by file.info() and 
file.access(), and furthermore allowed me as a standard user to create 
directories in areas over which it says I do not have write permission. We 
will look further into possible solutions, but it seems the Win32 API 
functions are giving the same answers.

Problems with 'access' (the C call underlying file.access()) mean that the 
MinGW compilers do not currently run on Vista without a lot of 
hoop-jumping.


[*] http://en.wikipedia.org/wiki/Fear,_uncertainty_and_doubt

-- 
Brian D. Ripley,                  ripley at stats.ox.ac.uk
Professor of Applied Statistics,  http://www.stats.ox.ac.uk/~ripley/
University of Oxford,             Tel:  +44 1865 272861 (self)
1 South Parks Road,                     +44 1865 272866 (PA)
Oxford OX1 3TG, UK                Fax:  +44 1865 272595