f64ba40f43
Confine Windows command execution through a WRITE_RESTRICTED token whose restricting SIDs carry an orphan-SID write allowlist, ported from https://github.com/huoyaoyuan/windows-acl-restrict-poc (@ 10e4dfb). Every Win32 call is checked and fails closed - the POC silently ran children with the FULL token when CreateRestrictedToken failed. - @deepseek-ai/dsh-sandbox-windows-acl: koffi primitives verified against the MinGW Windows headers (verify/abi-probe.cpp) plus the confinement runner ([node, runner, --workspace, --temp, --mode, --, argv...]: kill-on-close job, stdio passthrough, exit-code mirroring, windows-acl-run: failure signature, grant revocation). read-only = strict zero grants (NUL device not writable; documented). Windows-only execution: exempted from the Linux coverage lane (windowsOnlyCoverageExclusions). - @deepseek-ai/dsh-sandbox-local: PLATFORM_CHAINS.win32 filled with the windows-acl runner (full enforcement, ACL denial dialect, runner-failure rules). - @deepseek-ai/dsh-pwsh-sandbox: sandbox-consuming pwsh executor (call-for-call mirror of dsh-bash-sandbox) over a new argv-level seam in dsh-pwsh-local; per-file coverage complete via the fake-provider spec. - bundle/base: the Windows platform layer mounts the confined pwsh roster - sandbox/policy/fs-sandbox/permission/approval re-enabled, the POSIX bash stack stays disabled. Co-authored-by: Huo Yaoyuan <huoyaoyuan@hotmail.com>
59 lines
2.5 KiB
TypeScript
59 lines
2.5 KiB
TypeScript
/**
|
|
* The win32 chain's argv contract, denial dialect, and runner-failure rules,
|
|
* exercised through the REAL LocalSandboxProvider.confine() with an injected
|
|
* platform and runner argv prefix. Platform-independent assertions: they run
|
|
* in every CI lane (Windows included, where sandbox-local's own POSIX-only
|
|
* suites are excluded) — the end-to-end runner behavior lives in
|
|
* runner.spec.ts on win32 hosts.
|
|
*/
|
|
|
|
import { tmpdir } from 'node:os'
|
|
import { describe, expect, it, vi } from 'vitest'
|
|
import { Context } from 'cordis'
|
|
import type { SandboxPolicy } from '@deepseek-ai/dsh-sandbox'
|
|
import { LocalSandboxProvider } from '@deepseek-ai/dsh-sandbox-local'
|
|
|
|
const RO: SandboxPolicy = { mode: 'read-only', workspaceRoot: '/ws' }
|
|
const WW: SandboxPolicy = { mode: 'workspace-write', workspaceRoot: '/ws' }
|
|
|
|
async function setup(internals: LocalSandboxProvider['internals']) {
|
|
const ctx = new Context()
|
|
await ctx.plugin(LocalSandboxProvider, {})
|
|
const sandbox = ctx.sandbox as LocalSandboxProvider
|
|
sandbox.internals = internals
|
|
return sandbox
|
|
}
|
|
|
|
describe('windows-acl win32 chain (LocalSandboxProvider)', () => {
|
|
it('workspace-write: runner argv prefix, explicit temp, mode flag, full enforcement, ACL denial dialect', async () => {
|
|
const probeWindowsAcl = vi.fn(() => true)
|
|
const sandbox = await setup({
|
|
platform: 'win32',
|
|
windowsAclRunnerArgs: ['node', 'windows-acl-runner.js'],
|
|
probeWindowsAcl,
|
|
})
|
|
const confined = sandbox.confine(['pwsh', '/Command', 'x'], WW)
|
|
expect(confined.argv).toEqual([
|
|
'node', 'windows-acl-runner.js',
|
|
'--workspace', '/ws',
|
|
'--temp', tmpdir(),
|
|
'--mode', 'workspace-write',
|
|
'--',
|
|
'pwsh', '/Command', 'x',
|
|
])
|
|
expect(confined.enforcement).toBe('full')
|
|
expect(confined.denialSignatures).toEqual(['access is denied', 'access to the path', 'permission denied'])
|
|
expect(confined.runnerFailureRules).toEqual([{ fatalSignatures: ['windows-acl-run: '] }])
|
|
// A sole candidate is selected unprobed.
|
|
expect(probeWindowsAcl).not.toHaveBeenCalled()
|
|
})
|
|
|
|
it('read-only: same runner and contract, read-only mode flag', async () => {
|
|
const sandbox = await setup({ platform: 'win32', windowsAclRunnerArgs: ['node', 'windows-acl-runner.js'] })
|
|
const confined = sandbox.confine(['true'], RO)
|
|
expect(confined.argv.slice(-4)).toEqual(['--mode', 'read-only', '--', 'true'])
|
|
expect(confined.enforcement).toBe('full')
|
|
expect(confined.runnerFailureRules).toEqual([{ fatalSignatures: ['windows-acl-run: '] }])
|
|
})
|
|
})
|