mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(safeio): accept Windows effective full-control ACL

Browse Source
This commit is contained in:
marcopan
2026-08-18 12:52:37 +02:00
parent cd5f505c8a
commit a0e05ad392
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/tht/internal/safeio/private_windows.go
+5 -4
View File
@@ -329,10 +329,11 @@ func validateOwnerOnlyDACL(handle windows.Handle) error {
func isOwnerOnlyFullControlMask(mask uint32) bool { func isOwnerOnlyFullControlMask(mask uint32) bool {
// Windows may persist GENERIC_ALL in the ACE or expand it to the file-object // Windows may persist GENERIC_ALL in the ACE or expand it to the file-object
// full-control mask (including FILE_DELETE_CHILD). Both are the same semantic // full-control mask. FILE_ALL_ACCESS is the standard-rights set, synchronize,
// authority; any additional bit remains unsafe. // and all file-specific rights. Both are the same semantic authority; any
const fileDeleteChild = uint32(0x40) // additional or missing bit remains unsafe.
effective := uint32(windows.FILE_GENERIC_READ|windows.FILE_GENERIC_WRITE|windows.FILE_GENERIC_EXECUTE|windows.DELETE) | fileDeleteChild const fileSpecificAll = uint32(0x1ff)
effective := uint32(windows.STANDARD_RIGHTS_REQUIRED|windows.SYNCHRONIZE) | fileSpecificAll
return mask == uint32(windows.GENERIC_ALL) || mask == effective return mask == uint32(windows.GENERIC_ALL) || mask == effective
} }
tools/tht/internal/safeio/private_windows_test.go
+2 -2
View File
@@ -55,8 +55,8 @@ func TestPrivateWindowsDACLRejectsPermissiveDirectoryAndRegularFile(t *testing.T
} }
func TestOwnerOnlyDACLAcceptsWindowsFullControlMask(t *testing.T) { func TestOwnerOnlyDACLAcceptsWindowsFullControlMask(t *testing.T) {
const fileDeleteChild = uint32(0x40) const fileSpecificAll = uint32(0x1ff)
effectiveFullControl := uint32(windows.FILE_GENERIC_READ|windows.FILE_GENERIC_WRITE|windows.FILE_GENERIC_EXECUTE|windows.DELETE) | fileDeleteChild effectiveFullControl := uint32(windows.STANDARD_RIGHTS_REQUIRED|windows.SYNCHRONIZE) | fileSpecificAll
if !isOwnerOnlyFullControlMask(effectiveFullControl) { if !isOwnerOnlyFullControlMask(effectiveFullControl) {
t.Fatalf("effective Windows full-control mask %#x was rejected", effectiveFullControl) t.Fatalf("effective Windows full-control mask %#x was rejected", effectiveFullControl)
} }