mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(safeio): accept Windows effective full-control ACL

Browse Source
This commit is contained in:
marcopan
2026-08-18 12:52:37 +02:00
parent cd5f505c8a
commit a0e05ad392
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/tht/internal/safeio/private_windows.go
+5 -4
View File
@@ -329,10 +329,11 @@ func validateOwnerOnlyDACL(handle windows.Handle) error {
func isOwnerOnlyFullControlMask(mask uint32) bool {
// Windows may persist GENERIC_ALL in the ACE or expand it to the file-object
// full-control mask (including FILE_DELETE_CHILD). Both are the same semantic
// authority; any additional bit remains unsafe.
const fileDeleteChild = uint32(0x40)
effective := uint32(windows.FILE_GENERIC_READ|windows.FILE_GENERIC_WRITE|windows.FILE_GENERIC_EXECUTE|windows.DELETE) | fileDeleteChild
// full-control mask. FILE_ALL_ACCESS is the standard-rights set, synchronize,
// and all file-specific rights. Both are the same semantic authority; any
// additional or missing bit remains unsafe.
const fileSpecificAll = uint32(0x1ff)
effective := uint32(windows.STANDARD_RIGHTS_REQUIRED|windows.SYNCHRONIZE) | fileSpecificAll
return mask == uint32(windows.GENERIC_ALL) || mask == effective
}
tools/tht/internal/safeio/private_windows_test.go
+2 -2
View File
@@ -55,8 +55,8 @@ func TestPrivateWindowsDACLRejectsPermissiveDirectoryAndRegularFile(t *testing.T
}
func TestOwnerOnlyDACLAcceptsWindowsFullControlMask(t *testing.T) {
const fileDeleteChild = uint32(0x40)
effectiveFullControl := uint32(windows.FILE_GENERIC_READ|windows.FILE_GENERIC_WRITE|windows.FILE_GENERIC_EXECUTE|windows.DELETE) | fileDeleteChild
const fileSpecificAll = uint32(0x1ff)
effectiveFullControl := uint32(windows.STANDARD_RIGHTS_REQUIRED|windows.SYNCHRONIZE) | fileSpecificAll
if !isOwnerOnlyFullControlMask(effectiveFullControl) {
t.Fatalf("effective Windows full-control mask %#x was rejected", effectiveFullControl)
}