Windows: recompute deny set per exec and pin .git ancestor chain - #486
Open
ant-kurt wants to merge 1 commit into
Open
Windows: recompute deny set per exec and pin .git ancestor chain#486ant-kurt wants to merge 1 commit into
ant-kurt wants to merge 1 commit into
Conversation
Mandatory and configured denies are computed at wrap time and passed through srt-win exec --deny-*, held under the exec PID and released when it ends. Session initialize only applies grants. srt-win pins each real ancestor between a deny target and its modify-grant root with an object-only DELETE|WRITE_DAC deny.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Windows deny ACLs were stamped once at session initialize and recorded in the state database. A mandatory path that appeared later was never covered, a
.git\configACE stripped by git's own rewrite (MoveFileExdrops the DACL) stayed stripped until the next session, and stale records could leave stray ACEs behind. The mandatory and configured deny set is now computed at wrap time for every command and passed throughsrt-win exec --deny-read/--deny-write, held under the exec PID and released when it ends; session initialize applies grants only.The sandbox could also rename
.git(or any directory above it) aside and recreate the path unprotected.srt-winnow places an object-onlyDELETE|WRITE_DACdeny on every real directory between a deny target and its covering modify-grant root (SbAce::DenyPin); children keep their ownDELETE, soindex.lock → indexand other writes inside.gitare unaffected. Depth counting matches the Linux scan (mandatoryDenySearchDepth, default 3,node_modulesskipped).Test plan
test/sandbox/windows-per-exec-deny.test.ts: per-exec set composition (session ∪ per-exec ∪ credential ∪ mandatory, read-deny precedence,allowGitConfig), depth counting parity withrg --max-depth,node_modulesskip.state_dbunit testgrant_root_of_picks_deepest_modify_grant.