From 740d5b61b98e1644d5b1482fedb4db5eab6a3845 Mon Sep 17 00:00:00 2001 From: coso Date: Wed, 26 Aug 2026 19:08:33 +0800 Subject: [PATCH] fix(sandbox): grant default Windows read access --- .../codex-desktop-complete-alignment-plan.md | 5 +- .../crates/tool-runtime/src/windows_setup.rs | 15 +- .../src/windows_setup/read_access.rs | 304 ++++++++++++++++++ 3 files changed, 318 insertions(+), 6 deletions(-) create mode 100644 lime-rs/crates/tool-runtime/src/windows_setup/read_access.rs diff --git a/internal/exec-plans/codex-desktop-complete-alignment-plan.md b/internal/exec-plans/codex-desktop-complete-alignment-plan.md index bf345ced7..602332da2 100644 --- a/internal/exec-plans/codex-desktop-complete-alignment-plan.md +++ b/internal/exec-plans/codex-desktop-complete-alignment-plan.md @@ -5,7 +5,7 @@ > upstream: `/Users/coso/Documents/dev/rust/codex`（当前观测 HEAD：`99660ab3c7b861c916e467581fa9b8723504d66b`） > checklist progress: `44/46 (95.7%)`；这是未加权任务数，不等于交付完成度，剩余项包含 Windows 平台安全、live/verifier 与正式分发硬门槛。 -> 当前主目标（2026-08-26）：关闭 C-3 Windows restricted execution 的真机证据。Codex current 的 per-user Windows Firewall 非 loopback/loopback 出站阻断、offline/online sandbox identity、`LimeSandboxUsers` 普通 token ACL、短生命周期 capability SID restricted ACL、clean-runner setup/read-back、原始 DACL rollback、sandbox-account command runner 与七项 evidence collector 已进入唯一 current owner。真机已证明 runner transport/MSVC 编译成功，但 restricted child 仍在无输出前 exit `1`；当前下一刀是补齐 Codex setup 对 Windows 内置 `Users` 组成员身份的强制与 read-back，再重跑真实 Windows/MSVC 矩阵。在证据通过前保持 `Planned/enforced=false`。 +> 当前主目标（2026-08-26）：关闭 C-3 Windows restricted execution 的真机证据。Codex current 的 per-user Windows Firewall 非 loopback/loopback 出站阻断、offline/online sandbox identity、`LimeSandboxUsers` 普通 token ACL、短生命周期 capability SID restricted ACL、clean-runner setup/read-back、原始 DACL rollback、sandbox-account command runner 与七项 evidence collector 已进入唯一 current owner。真机已证明 runner transport/MSVC 编译和内置 `Users` setup/read-back 成功，但 restricted child 仍在无输出前 exit `1`；当前下一刀是补齐 Codex 对 Windows 平台目录与当前用户 profile 非敏感子目录的默认 RX ACL 刷新/read-back，再重跑真实 Windows/MSVC 矩阵。在证据通过前保持 `Planned/enforced=false`。 > 参考原则：`/Users/coso/Documents/dev/rust/codex` 是协议、Thread/Turn/Item、runtime lifecycle、tool/approval 和 GUI 语义的直接实现参考源；Lime 只在产品范围、provider 和桌面宿主边界做显式适配，不以旧矩阵或同名 legacy API 代替对齐。 > 目标：把 Lime 的产品主链、协议字段、GUI 工作区、执行安全和真实 Desktop 证据推进到当前 Codex Desktop 语义；不恢复已退役 runtime、v0 或 `agentSession/*` 兼容主链。 @@ -68,7 +68,7 @@ Renderer typed gateway | MCP resource origin | Workspace MCP App 从 canonical Item 的 `appContext`/resource URI 建立 WebContentsView surface，并以 `originCallId` 请求同一 Thread authority；`codex_apps` 不依赖本地 Plugin 安装态 | 已完成 canonical producer/cold restore、bounded provenance、link/account revalidation、稳定组件回归和独立 Electron Gate B；证据见 `.lime/qc/gui-evidence/mcp-resource-origin-electron-gate-b/` | | Environment lifecycle | `TaskCenterEnvironmentPanel` + `useThreadEnvironmentLifecycleStatus` 已消费 `environment/status` 与 typed connected/disconnected notification，稳定 DOM 覆盖环境 identity/status | 已完成五语言、组件回归和独立 Electron Gate B：真实远端 Environment 断线与有限重连在同一 canonical Thread 可见，mock/console/page/invoke error 为 0 | -当前执行顺序：Provider capability、Queue（含重复正文视觉收口）、Project、Strict Review、D-2 MCP event stream/resource origin、D-3 Environment、Thread Revert、Browser/Computer Use requirements 产品裁决、Thread/Item current 字段/恢复复核、Agent current 聚合门禁、本机 macOS packaged candidate、`1.135.0` 正式 macOS 分发和 Windows Squirrel N-1 packaged Gate B 已关闭；C-3 Windows restricted-token、ACL/Job、ConPTY、elevated setup、offline/online account、Firewall/WFP、readiness read-back、本地 fail-closed 单测和真实 packaged evidence collector 已进入 current owner。当前先对齐内置 `Users` 组成员身份并重跑七项 Windows/MSVC 安全矩阵；矩阵 `7/7` 后再验证 packaged runner digest。live provider/Pier/DeepSWE verifier 和覆盖当前工作树的正式分发同样等待外部环境。每完成一项即更新本计划与运行证据，不批量提前勾选。 +当前执行顺序：Provider capability、Queue（含重复正文视觉收口）、Project、Strict Review、D-2 MCP event stream/resource origin、D-3 Environment、Thread Revert、Browser/Computer Use requirements 产品裁决、Thread/Item current 字段/恢复复核、Agent current 聚合门禁、本机 macOS packaged candidate、`1.135.0` 正式 macOS 分发和 Windows Squirrel N-1 packaged Gate B 已关闭；C-3 Windows restricted-token、ACL/Job、ConPTY、elevated setup、offline/online account、Firewall/WFP、readiness read-back、本地 fail-closed 单测和真实 packaged evidence collector 已进入 current owner。当前先对齐默认平台/profile read roots 并重跑七项 Windows/MSVC 安全矩阵；矩阵 `7/7` 后再验证 packaged runner digest。live provider/Pier/DeepSWE verifier 和覆盖当前工作树的正式分发同样等待外部环境。每完成一项即更新本计划与运行证据，不批量提前勾选。 > 最新 Queue/CI 收口状态（2026-08-26）：Queue 状态条已删除 submission preview 与 `thread-queue-items` 正文列表，canonical 时间线成为唯一正文 owner；五语言只保留标题、loading、数量和刷新失败状态。组件、Gate B 与 Sherpa 定向回归 25/25，`npm run i18n:check` 保持 100%。真实 Queue Gate B 已通过：`timelineMarkerCount=1`、`queueStatusContainsMarker=false`、`queueItemsPresent=false`、47 次真实 Electron IPC、`mockFallbackHitCount=0`、console/page/invoke error 均为 0，证据见 `.lime/qc/gui-evidence/thread-queue-electron-gate-b/thread-queue-electron-gate-b-summary.json`。根 `package.json`/lock importer 已声明直接 `ws@8.18.3`，修复 Quality CI Frontend Full 的 `Failed to resolve import "ws"`；Windows Shell Runtime 上限调为 60 分钟，restricted security matrix 已前移到 Sherpa/sidecar 重型阶段之前，Sherpa 清理/解压前后输出阶段日志。`smoke:agent-runtime-current-fixture` 完整通过，`npm run verify:gui-smoke` Shell-01 21/21、contracts 299 checks、typecheck、scripts/legacy governance 均通过；App Server Windows sandbox fail-closed 定向单测 4/4 通过。上述本机测试不替代 Windows restricted matrix 或 live verifier；正式 macOS 与 Squirrel 证据由独立 Release run `32864956267` 证明。 @@ -394,6 +394,7 @@ Renderer typed gateway - 2026-08-26：Windows Quality run `32957046834`（SHA `e147a8731`）完成 setup/MSVC 编译，但六项 restricted case 在 child spawn 前统一返回 `CreateFileW(Windows sandbox NUL): ERROR_ACCESS_DENIED`，七项仍为 `1/7`。该证据证明低权限 sandbox-account runner 不能持有 NUL 的 `WRITE_DAC`；修复将 capability NUL lease 移至宿主，在 `CreateProcessWithLogonW` 前安装 ACE，并与 workspace ACL lease 一起由 supervisor/reaper 持有到 runner 及 descendants 退出，sandbox account 不获得全局 DACL 管理权。定向 related Rust `373/373`、fmt/diff check 通过；待下一轮 Windows schema v3 真机重跑，完成度/readiness 不变。 - 2026-08-26：Windows Quality run `32957785741`（SHA `a2a6caa85`，artifact `9602756033`）在 setup 阶段编译 `tool-runtime` 失败，七项矩阵未执行。MSVC `E0277` 明确指向 `NullDeviceLease` 持有 `LocalSid(*mut c_void)`，因此无法跨 supervisor/reaper 线程移动；修复为 lease 仅保存 capability SID 字符串，安装/撤销 ACE 时在当前线程短暂解析 `LocalSid`，不添加 `unsafe impl Send`。同时移除日志暴露的 Windows-only unused import；本机 related Rust 反向依赖链与 `tool-runtime 373/373`、rustfmt、`git diff --check` 通过。该 run 继续是 `failedStage=setup`、矩阵 `0/7`，不改变 `44/46 (95.7%)` 或 `Planned/enforced=false`。 - 2026-08-26：Windows Quality run `32958651645`（SHA `37f385db6`，artifact `9603104216`）已通过 setup 和 MSVC 编译，schema v3 七项矩阵完整执行为 `1/7`：Everyone-write audit 通过，其余六项 restricted child 仍在无输出前 exit `1`，terminate 场景因 runner 提前结束返回 `ControlClosed`。该 run 证明 NUL lease 的 `Send` 编译问题已关闭，但 NUL ACE 未解决 child 启动。继续对照 Codex `setup_main::sandbox_users` 发现 Lime 遗漏将 sandbox account 加入 Windows 内置 `Users`（SID `S-1-5-32-545`）；当前修复对本地化组名执行 setup 幂等加入、readiness 与每次 runner 启动 read-back，避免子进程缺少仅授权给内置 Users 的系统资源访问。完成度继续为 `44/46 (95.7%)`，readiness 继续 `Planned/enforced=false`。 +- 2026-08-26：Windows Quality run `32960057901`（SHA `f1bec2328`，artifact `9603664649`）再次通过 setup/MSVC 编译并完整执行 schema v3，但矩阵仍为 `1/7`；六项 restricted child 继续无有效输出 exit `1`，说明内置 `Users` 成员身份已正确写入/read-back，却不是唯一缺口。继续逐段对照 Codex `gather_read_roots -> run_setup_refresh -> apply_read_acls` 后确认 Lime 尚未刷新 `C:\Windows`、Program Files/ProgramData 与当前用户 profile 非敏感子目录的默认 RX ACL；这会让已创建的 restricted PowerShell 在加载 DLL、模块或 AppData 时静默失败。当前修复将该行为收归 Windows setup、补 read-back 并提升 setup marker version 强制旧安装重跑；完成度/readiness 不变。 ## 7. 阻塞与避让 diff --git a/lime-rs/crates/tool-runtime/src/windows_setup.rs b/lime-rs/crates/tool-runtime/src/windows_setup.rs index 26562a924..50dc8b816 100644 --- a/lime-rs/crates/tool-runtime/src/windows_setup.rs +++ b/lime-rs/crates/tool-runtime/src/windows_setup.rs @@ -9,6 +9,9 @@ use uuid::Uuid; #[cfg(windows)] #[path = "windows_setup/accounts.rs"] mod accounts; +#[cfg(windows)] +#[path = "windows_setup/read_access.rs"] +mod read_access; #[cfg(windows)] use accounts::{ @@ -21,8 +24,10 @@ pub(crate) use accounts::{ resolve_windows_account_sid, verify_windows_sandbox_group_membership, windows_sandbox_users_group_sid, }; +#[cfg(windows)] +use read_access::{ensure_default_read_access, validate_default_read_access}; -pub const WINDOWS_SANDBOX_SETUP_VERSION: u32 = 1; +pub const WINDOWS_SANDBOX_SETUP_VERSION: u32 = 2; pub const WINDOWS_SANDBOX_OFFLINE_USERNAME: &str = "LimeSandboxOffline"; pub const WINDOWS_SANDBOX_ONLINE_USERNAME: &str = "LimeSandboxOnline"; pub const WINDOWS_SANDBOX_USERS_GROUP: &str = "LimeSandboxUsers"; @@ -146,6 +151,7 @@ pub fn run_windows_sandbox_setup( ensure_local_group_member(WINDOWS_SANDBOX_USERS_GROUP, WINDOWS_SANDBOX_ONLINE_USERNAME)?; ensure_builtin_users_group_member(WINDOWS_SANDBOX_OFFLINE_USERNAME)?; ensure_builtin_users_group_member(WINDOWS_SANDBOX_ONLINE_USERNAME)?; + ensure_default_read_access()?; ensure_sandbox_accounts_null_device_access()?; let offline_blob = dpapi_protect(offline_password.as_bytes())?; @@ -493,6 +499,7 @@ fn validate_protected_password(label: &str, value: &str) -> Result<(), String> { fn validate_windows_runtime_artifacts(artifacts: &ValidatedSetupArtifacts) -> Result<(), String> { validate_windows_sandbox_group_membership(WINDOWS_SANDBOX_OFFLINE_USERNAME)?; validate_windows_sandbox_group_membership(WINDOWS_SANDBOX_ONLINE_USERNAME)?; + validate_default_read_access()?; validate_sandbox_accounts_null_device_access()?; validate_windows_sandbox_user("offline", &artifacts.users.offline)?; validate_windows_sandbox_user("online", &artifacts.users.online)?; @@ -746,7 +753,7 @@ mod tests { let marker_path = windows_sandbox_setup_marker_path(root.path()); fs::write( marker_path, - r#"{"version":2,"offline_username":"Other","online_username":"LimeSandboxOnline"}"#, + r#"{"version":3,"offline_username":"Other","online_username":"LimeSandboxOnline"}"#, ) .expect("rewrite marker"); @@ -765,7 +772,7 @@ mod tests { let marker_path = windows_sandbox_setup_marker_path(root.path()); fs::write( marker_path, - r#"{"version":1,"offline_username":"Other","online_username":"LimeSandboxOnline"}"#, + r#"{"version":2,"offline_username":"Other","online_username":"LimeSandboxOnline"}"#, ) .expect("rewrite marker"); @@ -784,7 +791,7 @@ mod tests { let marker_path = windows_sandbox_setup_marker_path(root.path()); fs::write( marker_path, - r#"{"version":1,"offline_username":"LimeSandboxOffline","online_username":"LimeSandboxOnline","unexpected":true}"#, + r#"{"version":2,"offline_username":"LimeSandboxOffline","online_username":"LimeSandboxOnline","unexpected":true}"#, ) .expect("rewrite marker"); diff --git a/lime-rs/crates/tool-runtime/src/windows_setup/read_access.rs b/lime-rs/crates/tool-runtime/src/windows_setup/read_access.rs new file mode 100644 index 000000000..9983bd6ba --- /dev/null +++ b/lime-rs/crates/tool-runtime/src/windows_setup/read_access.rs @@ -0,0 +1,304 @@ +use super::accounts::windows_sandbox_users_group_sid; +use super::to_wide; +use std::ffi::c_void; +use std::io; +use std::path::{Path, PathBuf}; +use std::ptr; +use windows_sys::Win32::Foundation::{LocalFree, ERROR_SUCCESS, HLOCAL}; +use windows_sys::Win32::Security::Authorization::{ + ConvertStringSidToSidW, GetEffectiveRightsFromAclW, GetNamedSecurityInfoW, SetEntriesInAclW, + SetNamedSecurityInfoW, EXPLICIT_ACCESS_W, GRANT_ACCESS, SE_FILE_OBJECT, TRUSTEE_IS_SID, + TRUSTEE_IS_UNKNOWN, TRUSTEE_W, +}; +use windows_sys::Win32::Security::{ACL, DACL_SECURITY_INFORMATION}; +use windows_sys::Win32::Storage::FileSystem::{FILE_GENERIC_EXECUTE, FILE_GENERIC_READ}; + +const BUILTIN_USERS_SID: &str = "S-1-5-32-545"; +const AUTHENTICATED_USERS_SID: &str = "S-1-5-11"; +const EVERYONE_SID: &str = "S-1-1-0"; +const PROFILE_ROOT_EXCLUSIONS: &[&str] = &[ + ".ssh", + ".tsh", + ".brev", + ".gnupg", + ".aws", + ".azure", + ".kube", + ".docker", + ".config", + ".npm", + ".pki", + ".terraform.d", +]; + +pub(super) fn ensure_default_read_access() -> io::Result<()> { + let sandbox_group = LocalSid::parse(&windows_sandbox_users_group_sid()?)?; + let builtin_users = LocalSid::parse(BUILTIN_USERS_SID)?; + let authenticated_users = LocalSid::parse(AUTHENTICATED_USERS_SID)?; + let everyone = LocalSid::parse(EVERYONE_SID)?; + let readable_principals = [ + sandbox_group.raw(), + builtin_users.raw(), + authenticated_users.raw(), + everyone.raw(), + ]; + + for root in default_read_roots()? { + with_path_dacl(&root, |dacl| { + if principals_allow_read_execute(dacl, &readable_principals)? { + return Ok(()); + } + grant_read_execute(&root, dacl, sandbox_group.raw()) + })?; + } + Ok(()) +} + +pub(super) fn validate_default_read_access() -> Result<(), String> { + let sandbox_group_sid = windows_sandbox_users_group_sid() + .map_err(|error| format!("sandbox group SID validation failed: {error}"))?; + let sandbox_group = LocalSid::parse(&sandbox_group_sid) + .map_err(|error| format!("sandbox group SID validation failed: {error}"))?; + let builtin_users = LocalSid::parse(BUILTIN_USERS_SID) + .map_err(|error| format!("built-in Users SID validation failed: {error}"))?; + let authenticated_users = LocalSid::parse(AUTHENTICATED_USERS_SID) + .map_err(|error| format!("Authenticated Users SID validation failed: {error}"))?; + let everyone = LocalSid::parse(EVERYONE_SID) + .map_err(|error| format!("Everyone SID validation failed: {error}"))?; + let principals = [ + sandbox_group.raw(), + builtin_users.raw(), + authenticated_users.raw(), + everyone.raw(), + ]; + + for root in default_read_roots().map_err(|error| error.to_string())? { + let allowed = with_path_dacl(&root, |dacl| { + principals_allow_read_execute(dacl, &principals) + }) + .map_err(|error| { + format!( + "default read root {} validation failed: {error}", + root.display() + ) + })?; + if !allowed { + return Err(format!( + "Windows sandbox cannot read and execute default root {}", + root.display() + )); + } + } + Ok(()) +} + +fn default_read_roots() -> io::Result> { + let mut roots = Vec::new(); + for (name, fallback) in [ + ("SystemRoot", Some(r"C:\Windows")), + ("ProgramFiles", Some(r"C:\Program Files")), + ("ProgramFiles(x86)", Some(r"C:\Program Files (x86)")), + ("ProgramData", Some(r"C:\ProgramData")), + ] { + let path = std::env::var_os(name) + .map(PathBuf::from) + .or_else(|| fallback.map(PathBuf::from)); + if let Some(path) = path.filter(|path| path.exists()) { + roots.push(path); + } + } + + if let Some(profile) = std::env::var_os("USERPROFILE").map(PathBuf::from) { + let entries = std::fs::read_dir(&profile).map_err(|error| { + io::Error::new( + error.kind(), + format!( + "failed to enumerate Windows user profile {}: {error}", + profile.display() + ), + ) + })?; + for entry in entries { + let entry = entry.map_err(|error| { + io::Error::new( + error.kind(), + format!( + "failed to enumerate Windows user profile {}: {error}", + profile.display() + ), + ) + })?; + let name = entry.file_name(); + let name = name.to_string_lossy(); + if !PROFILE_ROOT_EXCLUSIONS + .iter() + .any(|excluded| name.eq_ignore_ascii_case(excluded)) + { + roots.push(entry.path()); + } + } + } + + roots.sort_by(|left, right| { + left.to_string_lossy() + .to_ascii_lowercase() + .cmp(&right.to_string_lossy().to_ascii_lowercase()) + }); + roots.dedup_by(|left, right| { + left.to_string_lossy() + .eq_ignore_ascii_case(right.to_string_lossy().as_ref()) + }); + Ok(roots) +} + +fn with_path_dacl( + path: &Path, + operation: impl FnOnce(*mut ACL) -> io::Result, +) -> io::Result { + let path_wide = to_wide(path.as_os_str()); + let mut descriptor = ptr::null_mut(); + let mut dacl = ptr::null_mut(); + let result = unsafe { + GetNamedSecurityInfoW( + path_wide.as_ptr(), + SE_FILE_OBJECT, + DACL_SECURITY_INFORMATION, + ptr::null_mut(), + ptr::null_mut(), + &mut dacl, + ptr::null_mut(), + &mut descriptor, + ) + }; + if result != ERROR_SUCCESS { + return Err(win32_result_error( + &format!("GetNamedSecurityInfoW({})", path.display()), + result, + )); + } + if dacl.is_null() { + unsafe { + LocalFree(descriptor as HLOCAL); + } + return Err(io::Error::other(format!( + "Windows default read root {} has no DACL", + path.display() + ))); + } + let operation_result = operation(dacl); + unsafe { + if !descriptor.is_null() { + LocalFree(descriptor as HLOCAL); + } + } + operation_result +} + +fn principals_allow_read_execute(dacl: *mut ACL, principals: &[*mut c_void]) -> io::Result { + let required = FILE_GENERIC_READ | FILE_GENERIC_EXECUTE; + for principal in principals { + let trustee = trustee(*principal); + let mut effective = 0; + let result = unsafe { GetEffectiveRightsFromAclW(dacl, &trustee, &mut effective) }; + if result != ERROR_SUCCESS { + return Err(win32_result_error( + "GetEffectiveRightsFromAclW(default read root)", + result, + )); + } + if effective & required == required { + return Ok(true); + } + } + Ok(false) +} + +fn grant_read_execute(path: &Path, dacl: *mut ACL, sandbox_group: *mut c_void) -> io::Result<()> { + let entry = EXPLICIT_ACCESS_W { + grfAccessPermissions: FILE_GENERIC_READ | FILE_GENERIC_EXECUTE, + grfAccessMode: GRANT_ACCESS, + grfInheritance: 0x3, + Trustee: trustee(sandbox_group), + }; + let mut updated_dacl = ptr::null_mut(); + let result = unsafe { SetEntriesInAclW(1, &entry, dacl, &mut updated_dacl) }; + if result != ERROR_SUCCESS { + return Err(win32_result_error( + "SetEntriesInAclW(default read root)", + result, + )); + } + if updated_dacl.is_null() { + return Err(io::Error::other( + "SetEntriesInAclW(default read root) returned a null DACL", + )); + } + let path_wide = to_wide(path.as_os_str()); + let applied = unsafe { + SetNamedSecurityInfoW( + path_wide.as_ptr() as *mut u16, + SE_FILE_OBJECT, + DACL_SECURITY_INFORMATION, + ptr::null_mut(), + ptr::null_mut(), + updated_dacl, + ptr::null_mut(), + ) + }; + unsafe { + LocalFree(updated_dacl as HLOCAL); + } + if applied == ERROR_SUCCESS { + Ok(()) + } else { + Err(win32_result_error( + &format!("SetNamedSecurityInfoW({})", path.display()), + applied, + )) + } +} + +fn trustee(sid: *mut c_void) -> TRUSTEE_W { + TRUSTEE_W { + pMultipleTrustee: ptr::null_mut(), + MultipleTrusteeOperation: 0, + TrusteeForm: TRUSTEE_IS_SID, + TrusteeType: TRUSTEE_IS_UNKNOWN, + ptstrName: sid as *mut u16, + } +} + +struct LocalSid(*mut c_void); + +impl LocalSid { + fn parse(value: &str) -> io::Result { + let mut sid = ptr::null_mut(); + let value = to_wide(value); + if unsafe { ConvertStringSidToSidW(value.as_ptr(), &mut sid) } == 0 { + return Err(io::Error::last_os_error()); + } + Ok(Self(sid)) + } + + fn raw(&self) -> *mut c_void { + self.0 + } +} + +impl Drop for LocalSid { + fn drop(&mut self) { + if !self.0.is_null() { + unsafe { + LocalFree(self.0 as HLOCAL); + } + self.0 = ptr::null_mut(); + } + } +} + +fn win32_result_error(context: &str, code: u32) -> io::Error { + io::Error::other(format!( + "{context} failed: {}", + io::Error::from_raw_os_error(code as i32) + )) +}