Huanqi CaoandHuo Yaoyuan
f64ba40f43
Confine Windows command execution through a WRITE_RESTRICTED token whose restricting SIDs carry an orphan-SID write allowlist, ported from https://github.com/huoyaoyuan/windows-acl-restrict-poc (@ 10e4dfb). Every Win32 call is checked and fails closed - the POC silently ran children with the FULL token when CreateRestrictedToken failed. - @deepseek-ai/dsh-sandbox-windows-acl: koffi primitives verified against the MinGW Windows headers (verify/abi-probe.cpp) plus the confinement runner ([node, runner, --workspace, --temp, --mode, --, argv...]: kill-on-close job, stdio passthrough, exit-code mirroring, windows-acl-run: failure signature, grant revocation). read-only = strict zero grants (NUL device not writable; documented). Windows-only execution: exempted from the Linux coverage lane (windowsOnlyCoverageExclusions). - @deepseek-ai/dsh-sandbox-local: PLATFORM_CHAINS.win32 filled with the windows-acl runner (full enforcement, ACL denial dialect, runner-failure rules). - @deepseek-ai/dsh-pwsh-sandbox: sandbox-consuming pwsh executor (call-for-call mirror of dsh-bash-sandbox) over a new argv-level seam in dsh-pwsh-local; per-file coverage complete via the fake-provider spec. - bundle/base: the Windows platform layer mounts the confined pwsh roster - sandbox/policy/fs-sandbox/permission/approval re-enabled, the POSIX bash stack stays disabled. Co-authored-by: Huo Yaoyuan <huoyaoyuan@hotmail.com>
22 lines
850 B
TypeScript
22 lines
850 B
TypeScript
/**
|
|
* Fail-closed Win32 error type. Every backend API failure raises this with the
|
|
* API name and the exact Win32 code; the original POC silently ignored every
|
|
* failed call and would run children UNRESTRICTED (fail-open) — that is the
|
|
* failure mode this class exists to prevent.
|
|
* @module @deepseek-ai/dsh-sandbox-windows-acl/errors
|
|
*/
|
|
|
|
export class Win32Error extends Error {
|
|
/** The failing Win32 API name, e.g. `CreateRestrictedToken`. */
|
|
readonly api: string
|
|
/** The Win32 error code (`GetLastError` for BOOL APIs, the HRESULT-style return for ACL APIs). */
|
|
readonly win32Code: number
|
|
|
|
constructor(api: string, win32Code: number, detail?: string) {
|
|
super(`${api} failed (Win32 ${win32Code})${detail === undefined ? '' : `: ${detail}`}`)
|
|
this.name = 'Win32Error'
|
|
this.api = api
|
|
this.win32Code = win32Code
|
|
}
|
|
}
|