From f420e1aa5873e9fca6b201c45be78b19bbd742d9 Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Sun, 19 Jul 2026 01:04:27 +0200 Subject: [PATCH] diag(daemon): name the untrusted SID class in a DACL rejection The cache-private diagnostic pinned the guards failure to a private-dir DACL carrying a mutation ACE for an untrusted identity, but not WHICH - needed to tell a harness/profile ACL leak (an inherited Users / Authenticated Users / Everyone group ACE on the CI runner's admin profile) from a genuinely hostile grant. Classify the offending ACE's SID (BUILTIN\Users / Authenticated Users / Everyone / INTERACTIVE / other) in the message. Windows-only; mingw-verified. Signed-off-by: Martin Vogel --- src/daemon/ipc.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/daemon/ipc.c b/src/daemon/ipc.c index fb33e72f7..7737f15e2 100644 --- a/src/daemon/ipc.c +++ b/src/daemon/ipc.c @@ -3974,9 +3974,19 @@ static bool win_file_acl_secure(win_security_t *security, HANDLE file, DWORD mut size_t sid_capacity = (size_t)header->AceSize - sid_offset; bool creator_owner_inherit_only = (header->AceFlags & INHERIT_ONLY_ACE) != 0U; if (!win_bounded_sid_trusted(security, sid, sid_capacity, creator_owner_inherit_only)) { + /* Name the untrusted identity class so a harness/profile ACL leak + * (an inherited Users / Authenticated Users / Everyone ACE) is + * distinguishable from a genuinely hostile grant. */ + const char *sid_class = + security->is_well_known_sid((PSID)sid, WinBuiltinUsersSid) ? "BUILTIN\\Users" + : security->is_well_known_sid((PSID)sid, WinAuthenticatedUserSid) + ? "Authenticated Users" + : security->is_well_known_sid((PSID)sid, WinWorldSid) ? "Everyone" + : security->is_well_known_sid((PSID)sid, WinInteractiveSid) ? "INTERACTIVE" + : "other"; ipc_validation_detail_set( - "DACL entry %lu grants mutation rights 0x%08lx to an untrusted identity", - (unsigned long)index, (unsigned long)(ace->Mask & mutation)); + "DACL entry %lu grants mutation rights 0x%08lx to untrusted identity (%s)", + (unsigned long)index, (unsigned long)(ace->Mask & mutation), sid_class); secure = false; } }