How to Create a Full-Trust UWP App?

Question

Using the Desktop Bridge (formerly known as Project Centennial) through the DAC, one can create a full-trust UWP App. I thought this meant you can now create a Full-Trust UWP App and if so, how do you do that?

What I am trying to figure out is what configuration can I manually set on my UWP Project to grant it full-trust.

If you need some background, I need to create an Enterprise tool that has to be UWP. The application is going to be run on my company and one of the features that would make the UX better is to be able to access some parts of the file system outside of those allowed by UWP and preferably without the summoning of a dialog. Being able to run other DLL would also be a big plus; perhaps DLL Hell is desired this time around.

Answer 1

@Anzurio - just stumbled across your question and thought I'd share our experiences building the new Windows Terminal.

We originally set out to create the Terminal as a UWP app, with a nice modern XAML UI, but quickly found that the UWP app platform couldn't support a couple of our key requirements: 1. Terminal must be able to be launched elevated 2. Terminal must be able to launch & connect to arbitrary executables (e.g. cmd, powershell, wsl, etc.)

Because of these limitations, we had to create the Terminal as a standard Win32 process which contains a XAML Island which hosts the Terminal's Tab Bar and Terminal XAML Control instances in the main window frame.

We have taken care to keep as much app lifetime/logic code OUT of the Win32 host as we can, so that we'll have less work to do if/when the app platform does support our requirements and we get to ship a real UWP Terminal apps.

We are working with the app plat team to figure out how we might be able to build/full-trust modern apps more cleanly in the future.

In the meantime, I hope this response helps, and hope the Terminal source gives you some inspiration as to how to craft your own apps.

Answer 2

I don't know such of options. Yes, DAC can contain the Full-Trusted Win32 apps, but it is only applicable for Win32. UWP - WinRT - apps are restricted with App Container.

The alternative option is - using the "Special capabilities".

Special and restricted capabilities

There are many of declarations that overcome the restrictions of sandbox. Some of these are not applicable for store submission - only for in-house deployment apps. Others need registration for Microsoft to deploy with store. If your requirement is matched, you can use it.

(Added - June 2017) From Win10 AU, we can use the "FullTrustLauncher" API to launch the Win32 component from UWP App. But, yes, it does not mean we can run the "UWP" - WinRT process with full-trust rights. It's applicable only for Win32 process. And, the Win32 app executable should be contained in the application's AppX package and the manifest should declare the executable as "windows.fullTrustProcess".

  <Extensions> 
    <desktop:Extension Category="windows.fullTrustProcess" Executable="fulltrustprocess.exe"> 
      <desktop:FullTrustProcess> 
        <desktop:ParameterGroup GroupId="SyncGroup" Parameters="/Sync"/> 
        <desktop:ParameterGroup GroupId="OtherGroup" Parameters="/Other"/> 
      </desktop:FullTrustProcess> 
    </desktop:Extension> 
  </Extensions> 

Full​Trust​Process​Launcher Class