Skip to content

fix(windows): resolve kernel path via %SystemRoot%#288

Open
SAY-5 wants to merge 4 commits into
elastic:mainfrom
SAY-5:fix-287-kernel-systemroot
Open

fix(windows): resolve kernel path via %SystemRoot%#288
SAY-5 wants to merge 4 commits into
elastic:mainfrom
SAY-5:fix-287-kernel-systemroot

Conversation

@SAY-5
Copy link
Copy Markdown

@SAY-5 SAY-5 commented May 21, 2026

Fixes #287.

KernelVersion() called GetFileVersionInfo on a hardcoded C:\Windows\System32\ntoskrnl.exe, which fails with ERROR_FILE_NOT_FOUND on Windows hosts whose system drive is not C:\ (for example a server installed on W:\). The failure propagates through sysinfo.Host() and breaks Elastic Agent install/enroll on those hosts, as reported in the issue.

This PR resolves the kernel path through %SystemRoot% (falling back to %WINDIR%, then the historical C:\Windows default) and adds a t.Setenv-driven regression test covering each fallback step.

Local results:

  • GOOS=windows go build ./... clean for amd64 and arm64.
  • go run github.com/elastic/go-licenser@v0.4.2 -d clean.
  • gofmt and go vet clean.
  • The new TestKernelExePath table-test compiles and links cleanly on a Windows test binary (GOOS=windows go test -c).

I will add a .changelog/<pr>.txt entry once GitHub assigns the PR number.

SAY-5 added 2 commits May 21, 2026 00:56
KernelVersion() called GetFileVersionInfo on a hardcoded C:\Windows\System32\ntoskrnl.exe, which fails with ERROR_FILE_NOT_FOUND on Windows hosts whose system drive is not C:\. The failure propagates through sysinfo.Host() and breaks Elastic Agent install/enroll on such hosts. Resolve the kernel path through %SystemRoot% (falling back to %WINDIR% and then the existing C:\Windows default) and add a regression test.

Fixes elastic#287
Copy link
Copy Markdown
Contributor

@intxgo intxgo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this PR tries to address totally stripped environment by fallback to "C:\Windows", this can be mitigated in a safer way.

is calling API an option GetSystemWindowsDirectory

or reading a registry HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot

Signed-off-by: Sai Asish Y <say.apm35@gmail.com>
@SAY-5
Copy link
Copy Markdown
Author

SAY-5 commented May 26, 2026

Pushed 7a745fb. Switched to reading HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot via the registry (same pattern as os_windows.go). Env vars remain as fallback for stripped environments, hardcoded constant last resort.

Copy link
Copy Markdown
Contributor

@intxgo intxgo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but I have an opinion here. With the fix the behavior will be much better, however should the library decide on an arbitrary fallback const fallbackSystemRoot = C:\Windows ?

I think the client code could decide to do it, the library should return a "trusted" value or empty or error. Current behavior kind of still exhibit "half of" the original bug.

@andrewkroh
Copy link
Copy Markdown
Member

I opened #289 to address the unrelated CI failure. That needs merged first to unblock the rest of the CI pipeline in this change.

@SAY-5
Copy link
Copy Markdown
Author

SAY-5 commented May 28, 2026

Thanks, will rebase on top once #289 lands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Elastic Agent fails to install/enroll on Windows when system drive is not C:\

3 participants