Repository navigation
Conversation
Branch-only diagnostic, not for merge. The windows-latest run of the S6
shape fails three real-machine assertions: a fixture born under
%LOCALAPPDATA%\Temp carries three rows {SYSTEM, Administrators, the user}
flagged (OI)(CI)(F) with no (I), and after an acquire/release cycle — and
after a failed acquire's rollback — the same rows read back (I)-marked.
The 007dbd9 fix, which replays the as-found list through the raw writer as
release's and the rollback's last write, did not change the runner's
outcome. This machine never reproduces the failure: children born under
its Temp carry (I)-marked rows from the start, so the local suite walks a
different geometry and its 46/46 says nothing.
This commit exports the six DACL primitives and adds a diagnostic test
that dumps, at every phase — ancestry, birth, after each primitive of the
release sequence, the rollback, and three raw-write forges under different
control words — the byte-level DACL (control word, and per ACE the flags
byte, mask and SID) plus the icacls text. One CI run then answers what the
runner's birth stored, what a raw SetFileSecurityW write keeps on that
kernel, and which write adds the mark the final replay does not remove.
Co-Authored-By: LaBunbun Code <labunbun@zayoka.com>
…e both fixes Round 2 of the branch-only S6 diagnostic. Round 1 showed that on the runner a fixture born under %LOCALAPPDATA%\Temp stores unmarked rows (icacls shows no (I)) but the named reader returns them INHERITED-flagged, which is exactly the phantom bit the release replay writes back; this machine stores marked rows from birth, so the local suite never walks that path. Round 2 answers the question round 1 left open: whether a handle-based reader (GetSecurityInfo) or NtQuerySecurityObject returns the stored flags unmodified, or whether the promotion happens on every read path and the snapshot itself must strip the phantom bits. This test dumps named/raw/ntqs/icacls readings side by side for the ancestry, a 4x2 write matrix (control words 0x8004/0x8404/0x9004/0x9404 by row flags 0x03/0x13), the birth and post-release state of the protected-.git fixture, its failed-acquire rollback, and then simulates both candidate fixes on the real cycle and the rollback: replaying the raw-read birth rows, and replaying the named-read rows with phantom (I) bits stripped when the birth control word lacks SE_DACL_AUTO_INHERITED. Co-Authored-By: LaBunbun Code <labunbun@zayoka.com>
Owner
Author
|
The fix landed on main as dfcff79: the round found the capture reader — the runner's advapi32 readers promote explicit rows on the way out — so the three DACL restores now read through NtQuerySecurityObject (readStoredDacl). CI run 38795410305: all nine jobs green, windows leg 10043 pass / 0 fail with the three protected-directory assertions passing. Closing this diagnostic branch. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Branch-only diagnostic, not for merge. The windows runners currently fail three S6 assertions (rows born unmarked come back (I)-marked after the cycle, 007dbd9 notwithstanding) while every local machine stays green — the local geometry is a different one. This PR exists so one CI run can carry the byte-level readings (control word, per-ACE flags/mask/SID, icacls text) of the ancestry, the birth, every primitive of the release and rollback sequences, and raw-write forges under three control words. Do not merge.