Downlevel Support - Grant FILE_GENERIC_EXECUTE in readwrite/readonly path ACEs#448
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates AppContainer DACL access masks so granted filesystem paths include the execute/traverse bit needed for SetCurrentDirectoryW to chdir into allowed directories.
Changes:
- Adds
FILE_GENERIC_EXECUTEto read-write and read-only path ACE masks. - Updates compile-time mask assertions.
- Extends the access mask layout unit test to verify the
FILE_TRAVERSE/FILE_EXECUTEbit is present.
Show a summary per file
| File | Description |
|---|---|
src/wxc_common/src/filesystem_dacl.rs |
Widens AppContainer filesystem ACE masks and updates related assertions/tests. |
Copilot's findings
- Files reviewed: 1/1 changed files
- Comments generated: 2
MGudgin
force-pushed
the
user/gudge/add_execute_to_acls
branch
from
May 28, 2026 18:52
8e1ca70 to
1c9820f
Compare
alexsnitkovskiy
approved these changes
May 28, 2026
MGudgin
force-pushed
the
user/gudge/add_execute_to_acls
branch
from
May 28, 2026 20:29
1c9820f to
fbd3312
Compare
Member
Author
|
Run ADO Build please |
Member
Author
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
The previous masks (R | W | DELETE for rw, R for ro) lacked
FILE_EXECUTE — which on directory objects is the same bit (0x20) as
FILE_TRAVERSE. SetCurrentDirectoryW opens the target with
FILE_TRAVERSE, so any AppContainer child runtime-chdir'ing into a
granted directory hit ERROR_ACCESS_DENIED.
SeChangeNotifyPrivilege (Bypass Traverse Checking) only skips the
per-component FILE_TRAVERSE check on *intermediate* path elements;
the leaf opened by SetCurrentDirectoryW is still access-checked, so
the privilege the AppContainer token does carry does not help here.
Read and write workloads were unaffected because they only need bits
already in the mask. The fix unblocks runtime chdir into a granted
directory from any caller that bottoms out in SetCurrentDirectoryW —
cmd cd /d, node process.chdir, python os.chdir, git's internal chdir,
etc.
Higher-level shells with their own path-validation layers are not
addressed:
* pwsh Set-Location walks ancestor directories through the
FileSystemProvider, requiring FILE_LIST_DIRECTORY on C:\ and
every intermediate — orthogonal to the chdir primitive.
* git -C <dir> <cmd> chdir's successfully with this fix but then
fails at mingw_getcwd's GetFinalPathNameByHandleW
(VOLUME_NAME_DOS needs Mount Point Manager query access an
AppContainer doesn't carry); tracking upstream in
git-for-windows.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
MGudgin
force-pushed
the
user/gudge/add_execute_to_acls
branch
from
May 28, 2026 22:43
fbd3312 to
9334b65
Compare
Member
Author
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
alexsnitkovskiy
approved these changes
May 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The previous masks (R | W | DELETE for rw, R for ro) lacked FILE_EXECUTE — which on directory objects is the same bit (0x20) as FILE_TRAVERSE. SetCurrentDirectoryW opens the target with FILE_TRAVERSE, so any AppContainer child runtime-chdir'ing into a granted directory hit ERROR_ACCESS_DENIED.
SeChangeNotifyPrivilege (Bypass Traverse Checking) only skips the per-component FILE_TRAVERSE check on intermediate path elements; the leaf opened by SetCurrentDirectoryW is still access-checked, so the privilege the AppContainer token does carry does not help here.
Read and write workloads were unaffected because they only need bits already in the mask. The fix unblocks runtime chdir into a granted directory from any caller that bottoms out in SetCurrentDirectoryW — cmd cd /d, node process.chdir, python os.chdir, git's internal chdir, etc.
Higher-level shells with their own path-validation layers are not addressed:
Microsoft Reviewers: Open in CodeFlow