Environment
- wayland-core 0.12.8
- Windows 11 Pro 26200 (x64)
- Sandbox backend: AppContainer (Windows Tier-0 default)
Description
Any non-cmd shell whose runtime dependencies are not loadable under the Low-integrity, restricted-token AppContainer dies at image initialization with exit code -1073741515 = 0xC0000135 (STATUS_DLL_NOT_FOUND) and empty output. The user sees a silent failure with no indication of why.
Affected shells (reproductions)
pwsh / powershell: require .NET / GAC assemblies outside System32.- git-bash (
C:\Program Files\Git\usr\bin\bash.exe): requires msys-2.0.dll from Program Files\Git.
- busybox-w32 (a single static
.exe): also fails — even a bare busybox echo. Its PE static-import table is ADVAPI32, bcrypt, KERNEL32, msvcrt, Secur32, USER32, WS2_32; the non-cmd imports (Secur32, WS2_32, bcrypt, USER32) do not load under this token. (cmd works because its imports are the minimal System32 set.)
Expected
Either the shell runs, or the tool returns a clear, actionable error explaining that the shell is unsupported under the sandbox and what to do instead.
Actual
The child process dies at load with 0xC0000135, empty stdout/stderr, and no diagnostic — appearing to the user as "the command did nothing."
Note
A "static" shell is not automatically sandbox-compatible: busybox-w32 still links network/auth/UI system DLLs that the Low-IL restricted-token AppContainer cannot load.
Environment
Description
Any non-
cmdshell whose runtime dependencies are not loadable under the Low-integrity, restricted-token AppContainer dies at image initialization with exit code-1073741515=0xC0000135(STATUS_DLL_NOT_FOUND) and empty output. The user sees a silent failure with no indication of why.Affected shells (reproductions)
pwsh/powershell: require .NET / GAC assemblies outsideSystem32.C:\Program Files\Git\usr\bin\bash.exe): requiresmsys-2.0.dllfromProgram Files\Git..exe): also fails — even a barebusybox echo. Its PE static-import table isADVAPI32, bcrypt, KERNEL32, msvcrt, Secur32, USER32, WS2_32; the non-cmdimports (Secur32,WS2_32,bcrypt,USER32) do not load under this token. (cmdworks because its imports are the minimalSystem32set.)Expected
Either the shell runs, or the tool returns a clear, actionable error explaining that the shell is unsupported under the sandbox and what to do instead.
Actual
The child process dies at load with
0xC0000135, empty stdout/stderr, and no diagnostic — appearing to the user as "the command did nothing."Note
A "static" shell is not automatically sandbox-compatible: busybox-w32 still links network/auth/UI system DLLs that the Low-IL restricted-token AppContainer cannot load.