Repository navigation
windows: name the runner the sandbox user cannot read - #794
Open
TurtIeSocks wants to merge 1 commit into
Open
TurtIeSocks wants to merge 1 commit into
TurtIeSocks wants to merge 1 commit into
Conversation
When srt-sandbox cannot read the runner executable, CreateProcessWithLogonW fails with Access is denied (0x80070005) and spawn_runner ended with "ensure the Secondary Logon service (seclogon) is running", though seclogon was running. npx puts srt-win.exe under the user's npm cache, which the profile root keeps from the sandbox user, so this is the first error many Windows users see. logon::sandbox_can_read reads the file's DACL and answers whether Users, Authenticated Users, Everyone, the sandbox account or its group holds read and execute; None when the DACL cannot be read. On E_ACCESSDENIED, after the logon-failure, mapped-drive and seclogon arms, spawn_runner checks the current executable with it and, when the answer is Some(false), says the sandbox user cannot read it and how to fix that. A Some(true) or None keeps the old message, so a miss changes nothing. Unit tests pin each DACL shape: a grant to one account, to Everyone, a deny taking rights back, generic rights (which a DACL read back from a file never holds), read-data alone, and a string that is not a SID. Checked on Windows 11 ARM64 from the desktop session: a runner copied to %TEMP% now gets the new message naming it, and a readable runner still runs the command. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2 tasks
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When
srt-sandboxcan't read the runner,CreateProcessWithLogonWreturns Access is denied and srt-win says to check the Secondary Logon service, which is running. npx putssrt-win.exeunder the npm cache in the user's profile, so this is often the first error a Windows user sees.logon::sandbox_can_readchecks the exe's DACL for Users, Authenticated Users, Everyone, the sandbox account or its groupEvidence
Windows 11 ARM64,
srt-win execwith the runner copied to%TEMP%, through a tool that vendors this srt-win source:CreateProcessWithLogonW(srt-sandbox): Access is denied. (0x80070005) — ensure the Secondary Logon service (seclogon) is running.After:
the sandbox user cannot read and execute C:\...\Temp\unreadable-runner\<runner>.exe, so Windows refuses the launch as Access is denied. Grant it read and execute, or move it to a folder the sandbox user can read.A readable runner still runs.
cargo test --lib: 197 passed, with the same pre-existingprofilefailure.Merge Danger
Door: two-way
Blast Radius: one error message
Disclaimer: Code was generated by Claude 🤖 - reviewed and tested by a human 🐢