phase0: add fallback.allowDaclMutation config option#282
Conversation
| "readonlyPaths": ["C:\\data"], // Read-only access | ||
| "deniedPaths": ["C:\\Windows"] // Blocked paths | ||
| "deniedPaths": ["C:\\Windows"], // Blocked paths | ||
| "allowDaclFallback": true // Allow Tier 3 DACL fallback (default true) |
There was a problem hiding this comment.
As we continue to move forward with features UI, outside-in, etc... we will find more than just the need to fallback DACLs. Can we promote this to a property of the process container, or a general property on virtualization fallback?
There was a problem hiding this comment.
Force-pushed e1fb78c which lifts this out of filesystem into a new top-level fallback section. The field is now fallback.allowDaclMutation. Reasoning: we considered making it a single boolean at the container root vs. a structured section, and went with the section so future host-impacting fallbacks (UI, outside-in, etc.) can land as siblings without re-shuffling — and so an operator who has a different answer per axis isn't forced into a coupled one. Open to going coarser if you'd rather have a single root-level consent gate.
| } | ||
| ``` | ||
|
|
||
| ### Filesystem Policy |
There was a problem hiding this comment.
This document does not define all policies. Adding filesystem is ragged. We should probably add an issue to add documentation on all of the schema sections.
There was a problem hiding this comment.
Filed #285 to track full schema documentation coverage. Will keep this PR's scope limited to the new allowDaclFallback field.
microsoft-github-policy-service
Bot
added
Needs-Author-Feedback
MGudgin
force-pushed
the
user/gudge/downlevel_phase0
branch
from
f86d586 to
e1fb78c
Compare
MGudgin
changed the title
Introduces a new top-level `fallback` section on the MXC dev schema (0.6.0-dev), with a single occupant: `allowDaclMutation` (default: true). When the BaseContainer OS API is absent and bfscfg.exe is unavailable, MXC may fall back to applying DACL ACEs directly on policy paths (Tier 3 fallback). Because this modifies host filesystem security descriptors, operators need a way to refuse the fallback even though the original DACLs are restored on exit. The fallback section names operator consent for host-impacting containment fallbacks. It is intentionally a section rather than a filesystem-scoped flag so future host-mutating fallbacks can land alongside as siblings without re-shuffling. The default is true so that pre-GE Windows 11 builds - which currently have no other downlevel containment path - continue to work out of the box. Setting the field to false causes runs that would require Tier 3 to fail fast with a clear error (wired up in a later phase). Plumbed through: - schemas/dev/mxc-config.schema.0.6.0-dev.json (new top-level fallback object with allowDaclMutation property) - RawFallback in config_parser.rs (serde struct, optional on both RawConfig and the state-aware request envelope) - FallbackPolicy in models.rs (new struct with manual Default impl so allow_dacl_mutation defaults to true); ContainerPolicy gains a fallback: FallbackPolicy field - Mapping in load_request copies the value through, preserving the true default when the field is omitted - Three new unit tests covering default, explicit-true, explicit-false - docs/schema.md updated with a new Fallback Policy section No runner code is touched in this phase; consumers of fallback.allow_dacl_mutation are added in subsequent phases. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
MGudgin
force-pushed
the
user/gudge/downlevel_phase0
branch
from
e1fb78c to
ef387e8
Compare
microsoft-github-policy-service
Bot
removed
the
Needs-Attention
2 participants
📖 Description
Introduces a new top-level
fallbacksection on the MXC dev schema (0.6.0-dev), with a single occupant:allowDaclMutation(default:true). When the BaseContainer OS API is absent andbfscfg.exeis unavailable, MXC may fall back to applying DACL ACEs directly on policy paths (Tier 3 fallback). Because this modifies host filesystem security descriptors, operators need a way to refuse the fallback even though the original DACLs are restored on exit.The
fallbacksection names operator consent for host-impacting containment fallbacks. It is intentionally a section rather than a filesystem-scoped flag so future host-mutating fallbacks can land alongside as siblings without re-shuffling the schema. (Addresses review feedback on the prior shape.)The default is
trueso that pre-GE Windows 11 builds — which currently have no other downlevel containment path — continue to work out of the box. Setting the field tofalsecauses runs that would require Tier 3 to fail fast with a clear error (wired up in a later phase).Plumbed through:
schemas/dev/mxc-config.schema.0.6.0-dev.json(new top-levelfallbackobject withallowDaclMutationproperty)RawFallbackinconfig_parser.rs(new serde struct, optional on bothRawConfigand the state-aware request envelope)FallbackPolicyinmodels.rs(new struct with manualDefaultimpl soallow_dacl_mutationdefaults totrue);ContainerPolicygains afallback: FallbackPolicyfieldload_requestcopies the value through, preserving thetruedefault when the field is omitteddocs/schema.mdupdated with a new Fallback Policy sectionNo runner code is touched in this phase; consumers of
fallback.allow_dacl_mutationare added in subsequent phases (phase1+).This is phase 0 of the downlevel containment stack (phase0 → phase5). Subsequent PRs build on this one.
🔗 References
Part of the downlevel containment series. Schema-doc coverage tracked separately in #285.
🔍 Validation
config_parser.rscover the three field states (default, explicit true, explicit false).🤖 Generated with Claude Code