1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
|
using System.Runtime.InteropServices;
using System.Security.Principal;
namespace Agent.Windows.Security;
public sealed partial class AppContainerProfile
{
public const string FixedName = "AgentSandboxMcp.V1";
private const int AlreadyExists = unchecked((int)0x800700B7);
private AppContainerProfile(string name, SecurityIdentifier sid) { Name = name; Sid = sid; }
public string Name { get; }
public SecurityIdentifier Sid { get; }
public static AppContainerProfile EnsureFixed()
{
int result = Native.CreateAppContainerProfile(FixedName, "WinAgent Sandbox MCP", "Fixed sandbox profile for WinAgent Sandbox MCP", 0, 0, out nint sidPointer);
if (result == AlreadyExists) result = Native.DeriveAppContainerSidFromAppContainerName(FixedName, out sidPointer);
if (result < 0) Marshal.ThrowExceptionForHR(result);
try
{
return new(FixedName, new SecurityIdentifier(sidPointer));
}
finally
{
if (sidPointer != 0) _ = Native.FreeSid(sidPointer);
}
}
public static AppContainerProfile DeriveFixed()
{
int result = Native.DeriveAppContainerSidFromAppContainerName(FixedName, out nint sidPointer);
if (result < 0) Marshal.ThrowExceptionForHR(result);
try { return new(FixedName, new SecurityIdentifier(sidPointer)); }
finally { if (sidPointer != 0) _ = Native.FreeSid(sidPointer); }
}
private static partial class Native
{
[LibraryImport("userenv.dll", StringMarshalling = StringMarshalling.Utf16)]
internal static partial int CreateAppContainerProfile(string name, string displayName, string description, nint capabilities, uint capabilityCount, out nint sid);
[LibraryImport("userenv.dll", StringMarshalling = StringMarshalling.Utf16)]
internal static partial int DeriveAppContainerSidFromAppContainerName(string name, out nint sid);
[LibraryImport("advapi32.dll")]
internal static partial nint FreeSid(nint sid);
}
}
|
