From f2001b0c5a0b35e052ba62ef4f2e19bcc64fd870 Mon Sep 17 00:00:00 2001 From: tanaka takashi Date: Mon, 10 Aug 2026 02:26:09 +0900 Subject: perf(sandbox): apply ACLs at approved roots Replace per-descendant ACL enumeration, security descriptor snapshots, journal entries, audit events, and cleanup rewrites with one inheritable ACE and one snapshot per approved directory root. Exact file approvals continue to receive non-inheritable file ACEs, and nested roots retain independent least-privilege scopes cleaned in reverse order. Keep protected descendant DACLs protected instead of disabling inheritance protection. Such paths remain OS-denied, preserving fail-safe behavior without silently expanding the SandboxPolicy. Remove the obsolete descendant normalization pass. Restoring the root security descriptor removes inherited Application SID ACEs from existing and Task-created descendants; crash recovery performs the same root descriptor restoration from the journal. Add tests for existing-child inheritance, newly-created-child inheritance, protected descendants, one journal entry per root, exact descriptor restoration, no residual Application SID ACE, and independent-process crash recovery. Extend the existing elevated recovery and backend tests to validate inherited child cleanup and one ACL apply/restore event per root. Verification: Release build passed with 0 warnings and 0 errors; Core 50/50 passed; Planner 10/10 passed; focused ACL/recovery 3/3 passed; elevated Windows Security 28/28 passed; all reported skip 0. Operational evidence: the updated Release Bundle completed MCP Task 9b4a59a9-1f9b-4362-85f4-7b858899b488. ACL apply/restore decreased from 3,583/3,583 events taking 72/57 seconds to 3/3 root_inheritance events completing within the same second. WFP residual filters were 0 and the Task journal was removed. Release: refreshed the win-x64 self-contained folder bundle, clean ZIP, manifest, and checksum while preserving the local agent.yaml. Agent.Windows.dll SHA-256 is 24FDDD5727D5455170B6742B1D21E023A0BD70F92C225A2681BB5832C7AC0824; ZIP SHA-256 is EF7684C1A5A6155B774F4DF23CB08E9D1CF676351BF2B7D0F57915304495F456. No dependencies were added. --- plans/ImplementationPlan.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'plans/ImplementationPlan.md') diff --git a/plans/ImplementationPlan.md b/plans/ImplementationPlan.md index 8127701..5af7606 100644 --- a/plans/ImplementationPlan.md +++ b/plans/ImplementationPlan.md @@ -364,7 +364,7 @@ LLM→Tool→Policyの境界が固定され、Policyを通らない副作用経 - FilesystemPolicy R/W/E/Delete - canonical path - reparse point防御 -- NTFS ACL +- NTFS ACL（承認directory rootへの継承ACE、root単位snapshot、protected descendantのfail-safe維持） - Process approval canonical path + SHA-256 - shell toggle - Job Object @@ -407,6 +407,7 @@ ST-01〜11、16全PASS。Security不具合を残したまま進行禁止。 - Recovery Journal - CLEAN / PREPARING / APPLIED / RUNNING / CLEANING / RECOVERY_REQUIRED - ACL適用前journal flush +- ACL journalは承認root単位とし、既存・新規descendantの継承とroot復元を検証 - Task Resource ownership - cleanup逆順処理 - 起動前Recovery -- cgit v1.2.3