diff options
Diffstat (limited to 'src/Agent.Windows/Tools/WindowsToolBackend.cs')
| -rw-r--r-- | src/Agent.Windows/Tools/WindowsToolBackend.cs | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/src/Agent.Windows/Tools/WindowsToolBackend.cs b/src/Agent.Windows/Tools/WindowsToolBackend.cs index af4c906..ec122e9 100644 --- a/src/Agent.Windows/Tools/WindowsToolBackend.cs +++ b/src/Agent.Windows/Tools/WindowsToolBackend.cs @@ -48,6 +48,10 @@ public sealed class WindowsToolBackend(EffectiveSandboxPolicy settings, ISecurit _taskUpdates.BeginTask(taskId, sessionId); try { + string[] osRuntimeRoots = settings.Files + .Where(static entry => entry.Origin.Split(',').Contains("os_runtime_root", StringComparer.Ordinal)) + .Select(static entry => ResolvedPath.Resolve(entry.Path, false)) + .ToArray(); foreach ((string path, FileCapability capabilities, bool osRuntimeRoot) in settings.Files .GroupBy(static entry => ResolvedPath.Resolve(entry.Path, false), StringComparer.OrdinalIgnoreCase) .Select(static group => (group.Key, @@ -57,9 +61,12 @@ public sealed class WindowsToolBackend(EffectiveSandboxPolicy settings, ISecurit // System32 has a protected OS-owned DACL. Its existing LPAC access is verified by // real process-tree tests; changing or unprotecting that DACL is forbidden. if (osRuntimeRoot) continue; - // OS/runtime executables may already grant AppContainer execute through their protected system ACL. - // Do not rewrite a file ACL when execute is the only requested capability; CreateProcess remains - // constrained by LPAC access plus Resolved Path/SHA-256 Entry approval. + // Approved System32 Entry files are nested under the same protected OS Runtime Root. + // Their existing LPAC access is used; a separate file-level DACL rewrite is forbidden. + if (File.Exists(path) && capabilities == (FileCapability.Read | FileCapability.Execute) && + osRuntimeRoots.Any(root => IsBelow(path, root))) continue; + // Executable-only entries may already grant AppContainer execute through their system ACL. + // CreateProcess remains constrained by LPAC access plus Resolved Path/SHA-256 Entry approval. if (File.Exists(path) && capabilities == FileCapability.Execute) continue; // A single inheritable ACE on an approved directory covers existing and newly-created // descendants. Snapshotting and rewriting every child ACL is both redundant and @@ -305,6 +312,9 @@ public sealed class WindowsToolBackend(EffectiveSandboxPolicy settings, ISecurit } private TaskContext Get(Guid taskId) => _contexts.TryGetValue(taskId, out TaskContext? context) ? context : throw new InvalidOperationException("Task Resource scope is not active."); + private static bool IsBelow(string child, string parent) => + child.StartsWith(parent.TrimEnd(Path.DirectorySeparatorChar) + Path.DirectorySeparatorChar, + StringComparison.OrdinalIgnoreCase); private static ToolExecutionResult Success(string output, bool externalEffect = false) => new(true, output, externalEffect); private static bool IsTextMatch(string path, Func<string, bool> predicate) { |