Don't fail if applicationPool already contains a given environment variable

[andrewlock]

One of the main behaviors of ServiceMonitor.exe is to promote its environment variables to the applicationPool's config. However, if the environment variable is already defined for the pool, then ServiceMonitor.exe fails.

We are currently running into this issue now. Ideally it would be nice if ServiceMonitor.exe could skip environment variables that are already defined for the pool. There are a couple of ways this could be achieved in UpdateEnvironmentVarsToConfig , for example:

• For each pool, retrieve the currently set env vars (if any), and skip those that are set.
• Or, set each environment variable individually. If it fails, just skip it (assume already defined) and move to the next.

An alternative approach would be to allow adding to the deny list. e.g. you could support a SERVICEMONITOR_ADDITIONAL_SKIP_VARIABLES variable in FilterEnv that defines the variables to skip:

• SERVICEMONITOR_ADDITIONAL_VARIABLES="MY_FIRST_VAR,MY_SECOND_VAR"

Would you be open to either of these options? We would be happy to contribute the feature if so?

[craigminihan]

I suspect I have a simple repo case which closely matches @andrewlock's issue above:

PS c:\> docker run -ti --rm --entrypoint powershell.exe mcr.microsoft.com/dotnet/framework/aspnet:4.8.1

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved
PS C:\> .\ServiceMonitor.exe w3svc

Stopping service 'w3svc'
Service 'w3svc' has been stopped
Service 'w3svc' started
CTRL signal received. The process will now terminate.
Stopping service 'w3svc'
Service 'w3svc' has been stopped

PS C:\> $env:EnvVarOfDoom="true"

PS C:\> .\ServiceMonitor.exe w3svc

Service 'w3svc' has been stopped
APPCMD failed with error code 183
Failed to update IIS configuration

The problem is caused by the interaction of RunCommand(pstrRmCmd, TRUE) and RunCommand(pstrAddCmd, FALSE) as follows:

• when the container is started as above and ServiceMonitor is executed the first RunCommand (which attempts to remove env vars) fails - there are no env vars so this isn't an issue yet
• stopping the service via CTRL-C drops us back to the prompt, now we add a new env var here and start ServiceMonitor again
• the second call to RunCommand fails (again) and is ignored, the second call to RunCommand also fails but this time we terminate due to he action of FALSE

IMHO the first call to RunCommand() should only remove the env vars present in the app pool, instead it will always executes at least the following:

PS C:\> C:\Windows\system32\inetsrv\appcmd.exe set config -section:system.applicationHost/applicationPools `
     /-"[name='DefaultAppPool'].environmentVariables.[name='COMPLUS_NGenProtectedProcess_FeatureEnabled']" `
     /-"[name='DefaultAppPool'].environmentVariables.[name='COMPLUS_RUNNING_IN_CONTAINER']" `
     /-"[name='DefaultAppPool'].environmentVariables.[name='DOTNET_RUNNING_IN_CONTAINER']" `
     /-"[name='DefaultAppPool'].environmentVariables.[name='PATHEXT']" `
     /-"[name='DefaultAppPool'].environmentVariables.[name='PSModulePath']" `
     /-"[name='DefaultAppPool'].environmentVariables.[name='ROSLYN_COMPILER_LOCATION']" `
     /commit:apphost
ERROR ( message:Cannot find requested collection element. )
PS C:\> $LASTEXITCODE
4312

In the example above ServiceMonitor executes appcmd with at least this set of env vars, if EnvVarOfDoom is added to the list as it is on the second execution it will always fail removing none of the env vars.

Now when RunCommand(pstrAddCmd, FALSE) is executed for the second time it will always fail since the env vars it attempts to add are already present:

C:\Windows\system32\inetsrv\appcmd.exe set config -section:system.applicationHost/applicationPools `
    /+"[name='DefaultAppPool'].environmentVariables.[name='COMPLUS_NGenProtectedProcess_FeatureEnabled',value='0']" `
    /+"[name='DefaultAppPool'].environmentVariables.[name='COMPLUS_RUNNING_IN_CONTAINER',value='1']" `
    /+"[name='DefaultAppPool'].environmentVariables.[name='DOTNET_RUNNING_IN_CONTAINER',value='true']" `
    /+"[name='DefaultAppPool'].environmentVariables.[name='EnvVarOfDoom',value='true']" `
    /+"[name='DefaultAppPool'].environmentVariables.[name='PATHEXT',value='.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL']" `
    /+"[name='DefaultAppPool'].environmentVariables.[name='PSModulePath',value='C:\Users\ContainerAdministrator\Documents\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules']" `
    /+"[name='DefaultAppPool'].environmentVariables.[name='ROSLYN_COMPILER_LOCATION',value='C:\RoslynCompilers-3.6.0\tools']" `
    /commit:apphost
ERROR ( message:New add object missing required attributes. Cannot add duplicate collection entry of type 'add' with unique key attribute 'name' set to 'COMPLUS_NGenProtectedProcess_FeatureEnabled'
. )
PS C:\servicemonitor> $LASTEXITCODE
183

Use C:\Windows\system32\inetsrv\appcmd.exe list config -section:system.applicationHost/applicationPools to see the app pool env vars

[craigminihan]

For reference the default application pool env vars can be removed with:

[string] $defaultAppPoolName = 'DefaultAppPool'
[string] $appCmd = 'C:\Windows\system32\inetsrv\appcmd.exe'

[object] $xml = [xml] (&$appCmd list config -section:system.applicationHost/applicationPools)
if (!$?) {
    Write-Error 'Failed to clean up application pool configuration'
}

$xml.SelectNodes("/system.applicationHost/applicationPools/add[@name='${defaultAppPoolName}']/environmentVariables/*") | ForEach-Object {
    [string] $name = $_.name

    Write-Host "Removing environment variable '${name}'..."
    &$appCmd set config -section:system.applicationHost/applicationPools `
        /-"[name='${defaultAppPoolName}'].environmentVariables.[name='${name}']" `
        /commit:apphost
}