From 9d850142f395c75c70e84edb415ea4c388a22db9 Mon Sep 17 00:00:00 2001 From: Ali Robertson Date: Wed, 7 Oct 2026 12:46:00 +1100 Subject: [PATCH] installer: add the Mandatory ASLR exceptions by default The "Security options" page is only shown when Mandatory ASLR is enabled system-wide, i.e. exactly when Git Bash, SSH and the other MSYS2 programs cannot fork without the exceptions. Yet its checkbox defaults to unchecked, so silent installs (e.g. `winget install Git.Git`) on such systems leave a Git Bash that fails with fork: child -1 - forked process ... died unexpectedly, retry 0, exit code 0xC0000142 Check it by default instead. An explicit choice, recorded or passed via `/o:AddmandatoryASLRsecurityexceptions=Disabled`, is still honored. Signed-off-by: Ali Robertson Co-Authored-By: Claude Opus 5.5 --- installer/install.iss | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/installer/install.iss b/installer/install.iss index 281cda647e..3479b7c4c7 100644 --- a/installer/install.iss +++ b/installer/install.iss @@ -2474,7 +2474,7 @@ begin #endif SecurityOptionsPage:=CreatePage(PrevPageID,'Security options','Add mandatory ASLR security exceptions?',TabOrder,Top,Left); RdbSecurityOptions[SO_MandatoryASLR]:=CreateCheckBox(SecurityOptionsPage, 'Add mandatory ASLR security exceptions','Add mandatory ASLR security exceptions for the executables in the "usr/bin"'+#13+'directory and Git Bash to function correctly on Windows systems with'+#13+'mandatory ASLR enabled which is a Windows security feature that is'+#13+'disabled by default but appears to be enabled on your system.'+#13++#13+'WARNING: If you have installed Git to a path modifiable by an unprivileged user'+#13+'or an external drive this will add mandatory ASLR security exceptions for'+#13+'those paths on which could introduce a security vulnerability!'+#13++#13+'WARNING: Doing this significantly slows down the load time of the program'+#13+'settings list in the exploit protection section of the Windows security application'+#13+'but it will load eventually!',TabOrder,Top,Left); - RdbSecurityOptions[SO_MandatoryASLR].Checked:=ReplayChoice('Add mandatory ASLR security exceptions','Auto')='Enabled'; + RdbSecurityOptions[SO_MandatoryASLR].Checked:=ReplayChoice('Add mandatory ASLR security exceptions','Auto')<>'Disabled'; end; #ifdef HAVE_EXPERIMENTAL_OPTIONS