trending/codebase-memory-mcp
1
0
Fork 0
mirror of https://github.com/DeusData/codebase-memory-mcp.git synced 2026-11-10 09:13:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

diag(daemon): name the untrusted SID class in a DACL rejection

Browse Source 
The cache-private diagnostic pinned the guards failure to a private-dir
DACL carrying a mutation ACE for an untrusted identity, but not WHICH -
needed to tell a harness/profile ACL leak (an inherited Users /
Authenticated Users / Everyone group ACE on the CI runner's admin
profile) from a genuinely hostile grant. Classify the offending ACE's
SID (BUILTIN\Users / Authenticated Users / Everyone / INTERACTIVE /
other) in the message. Windows-only; mingw-verified.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
This commit is contained in:
Martin Vogel
2026-07-19 01:04:27 +02:00
parent 4cb05faa37
commit f420e1aa58
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/daemon/ipc.c
+12 -2
View File
@@ -3974,9 +3974,19 @@ static bool win_file_acl_secure(win_security_t *security, HANDLE file, DWORD mut
size_t sid_capacity = (size_t)header->AceSize - sid_offset;
bool creator_owner_inherit_only = (header->AceFlags & INHERIT_ONLY_ACE) != 0U;
if (!win_bounded_sid_trusted(security, sid, sid_capacity, creator_owner_inherit_only)) {
/* Name the untrusted identity class so a harness/profile ACL leak
* (an inherited Users / Authenticated Users / Everyone ACE) is
* distinguishable from a genuinely hostile grant. */
const char *sid_class =
security->is_well_known_sid((PSID)sid, WinBuiltinUsersSid) ? "BUILTIN\\Users"
: security->is_well_known_sid((PSID)sid, WinAuthenticatedUserSid)
? "Authenticated Users"
: security->is_well_known_sid((PSID)sid, WinWorldSid) ? "Everyone"
: security->is_well_known_sid((PSID)sid, WinInteractiveSid) ? "INTERACTIVE"
: "other";
ipc_validation_detail_set(
"DACL entry %lu grants mutation rights 0x%08lx to an untrusted identity",
(unsigned long)index, (unsigned long)(ace->Mask & mutation));
"DACL entry %lu grants mutation rights 0x%08lx to untrusted identity (%s)",
(unsigned long)index, (unsigned long)(ace->Mask & mutation), sid_class);
secure = false;
}
}