Repository navigation

fix(sandbox): keep Windows restricted-token SIDs narrow and fail closed on DenyRead - #1006

Merged

kevincodex1 merged 9 commits into

Twigpine:mainfrom

euxarist:fix/windows-sandbox-restricted-token-sids-v2

Sep 12, 2026

Merged

fix(sandbox): keep Windows restricted-token SIDs narrow and fail closed on DenyRead#1006
kevincodex1 merged 9 commits into
Twigpine:mainfrom
euxarist:fix/windows-sandbox-restricted-token-sids-v2

Commits on Aug 31, 2026
- fix(sandbox): keep Windows restricted-token SIDs narrow and fail closed on DenyRead
  euxaristia
  committed
  92ca672
- fix(sandbox): address CodeRabbit review feedback on PR 640
  euxaristia
  committed
  fe07a52
- refactor(sandbox): Address CodeRabbit nitpicks on PR 640.
  
  euxaristia
  and
  cairn-code
  committed
  5465b0f
- fix(sandbox): skip inherited ACEs and reject DenyRead upfront during setup
  euxaristia
  committed
  d9d72e8
Commits on Sep 1, 2026
- Reject unsupported DenyRead profiles upfront during sandbox setup
  euxaristia
  committed
  90d056a
Commits on Sep 2, 2026
- Migrate legacy Windows DenyWrite ACEs, randomize smoke probes, and clean dead descendant machinery.
  euxaristia
  committed
  a84626f
Commits on Sep 4, 2026
- Use /d /c for denied-write probe command and verify ownership on cleanup.
  euxaristia
  committed
  6c4d6c3
- Honor NoInherit in legacy ACL migration and verify probe ownership.
  euxaristia
  committed
  92bdafa
- Preserve DenyRead bits when migrating combined legacy deny ACEs.
  euxaristia
  committed
  5c46b75