phase1: integrate Win32k mitigation and UI Job Object into AppContainer runner#308
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Integrates stronger UI containment into the Windows AppContainer runner by applying Win32k syscall-disable mitigation at process creation time and enforcing UI restrictions via a Windows Job Object before the child begins executing.
Changes:
- Adds
PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY(Win32k disable) to theCreateProcessWattribute list whenpolicy.ui.disableis enabled. - Switches child creation to
CREATE_SUSPENDED, assigns it to aUiJobObjectwith resolved UI limits, then resumes the primary thread. - Adds a small helper (
compute_attr_count) plus unit tests to correctly size the proc-thread attribute list.
Show a summary per file
| File | Description |
|---|---|
src/wxc_common/src/appcontainer_runner.rs |
Applies Win32k mitigation via startup attributes and enforces UI limits via a Job Object prior to resuming the suspended child process. |
Copilot's findings
- Files reviewed: 1/1 changed files
- Comments generated: 2
MGudgin
force-pushed
the
user/gudge/downlevel_phase1_integrate
branch
from
May 14, 2026 15:05
c2d1bb8 to
b499fc7
Compare
MGudgin
force-pushed
the
user/gudge/downlevel_phase1_integrate
branch
from
May 14, 2026 15:48
b499fc7 to
1cc2ced
Compare
…runner
Wires two pre-existing pieces of UI-restriction plumbing into the
AppContainer process-creation path, so downlevel sandboxes (where the
BaseContainer API is unavailable) get the same defenses the
BaseContainer backend already enforces via its SandboxSpec:
- Win32k syscall disable, via PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY
added to the proc-thread attribute list passed to CreateProcessW.
Applied when policy.ui.disable is true.
- UI restrictions (clipboard, input injection, IME, global atoms,
desktop switching, etc.) via JOB_OBJECT_UILIMIT_* on a UiJobObject
the child is assigned to. Drawn from ui_policy::resolve_ui_restrictions.
Both restrictions must take effect *before* the child runs any code,
otherwise the un-restricted prelude is a window of opportunity. The
runner therefore now creates the child CREATE_SUSPENDED, creates the
job and assigns the process while the child is still parked, and only
then ResumeThreads. The CREATE_SUSPENDED window is treated as
fail-closed: any error between CreateProcess and ResumeThread runs
TerminateProcess on the suspended child so a sandboxed-but-unrestricted
process can never escape into execution.
Two diagnostic log lines confirm each mitigation took effect at runtime
("Win32k mitigation applied to child process", "UI Job Object assigned
to child process"), aiding post-hoc diagnosis on systems where these
APIs may silently degrade.
Adds compute_attr_count() to size the proc-thread attribute list as a
function of which mitigations are active for the current policy, plus
unit tests covering the four (LPAC × ui-disable) combinations.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
MGudgin
force-pushed
the
user/gudge/downlevel_phase1_integrate
branch
from
May 14, 2026 19:16
1cc2ced to
8cc6e01
Compare
alexsnitkovskiy
approved these changes
May 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY) to the child process at spawn time, alongside the existingSECURITY_CAPABILITIESand (when LPAC)ALL_APPLICATION_PACKAGES_POLICYattributes.CREATE_SUSPENDED, assigns it to a UI-restrictionUiJobObject, then resumes — so UI restrictions apply before any code runs in the child.Win32k mitigation applied to child process,UI Job Object assigned to child process), aiding post-hoc diagnostics.Test plan
cargo check -p wxc -p wxc_common --testsclean on Windowscargo test -p wxc_commonpassesui_disable=trueand confirm child cannot calluser32::FindWindowW/ cannot open keyboard or window handles in other sessionsContext
First commit in the BaseContainer-downlevel fallback chain.
🤖 Generated with Claude Code