Function win_runtime_directory_secure

src/daemon/ipc.c:4359–4452

}

static bool win_runtime_directory_secure(const wchar_t *runtime_dir) {
    win_security_t security;
    if (!win_security_init(&security)) {
        return false;
    }
    bool created = CreateDirectoryW(runtime_dir, &security.directory_attributes) != 0;
    if (!created && GetLastError() != ERROR_ALREADY_EXISTS) {
        win_security_destroy(&security);
        return false;
    }
    DWORD attributes = GetFileAttributesW(runtime_dir);
    if (attributes == INVALID_FILE_ATTRIBUTES || (attributes & FILE_ATTRIBUTE_DIRECTORY) == 0 ||
        (attributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) {
        win_security_destroy(&security);
        return false;
    }
    HANDLE directory =
        CreateFileW(runtime_dir, READ_CONTROL | WRITE_DAC | WRITE_OWNER,
                    FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING,
                    FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, NULL);
    bool can_write_owner = directory != INVALID_HANDLE_VALUE;
    if (!can_write_owner) {
        directory =
            CreateFileW(runtime_dir, READ_CONTROL | WRITE_DAC,
                        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING,
                        FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OPEN_REPARSE_POINT, NULL);
    }
    if (directory == INVALID_HANDLE_VALUE) {
        win_security_destroy(&security);
        return false;
    }
    BY_HANDLE_FILE_INFORMATION file_info;
    bool valid_handle = GetFileInformationByHandle(directory, &file_info) != 0 &&
                        (file_info.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0 &&
                        (file_info.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) == 0;
    bool owner_exact = valid_handle && win_file_owner_secure(&security, directory, true);
    /* One-time normalization of the admin-group default-owner artifact: a
     * directory created by plain mkdir under an Administrators-default-owner
     * token (standard policy on Windows Server) is born owned by BUILTIN\
     * Administrators even though it is this account's own private dir. A
     * TRUSTED owner (the launcher's directory policy: SYSTEM, Administrators,
     * TrustedInstaller) is re-stamped to the exact token user inside the same
     * repair that already re-protects the DACL; any other owner remains
     * refused, and the final validation below still demands the exact user. */
    bool owner_ok = owner_exact || (valid_handle && can_write_owner &&
                                    win_file_owner_secure(&security, directory, false));
    /* Re-stamp only when the directory is not ALREADY correct.
     *
     * This used to fire on every process start, whether or not anything was
     * wrong. Two costs, both observed in the field:
     *
     *  - It rewrites the security descriptor of a directory that already has
     *    the right one, and Windows propagates that to children. #1601 counted
     *    ELEVEN "Security change" USN records against a single _config.db in
     *    one day, none of which changed anything.
     *  - Every rewrite is a window. #1620 loses an atomic publish to exactly
     *    this: MoveFileEx needs DELETE on the destination, and a concurrent
     *    re-protect of the parent is a chance to be refused for a state that is