From c8b807176ef289094d7c6018221872a755219c56 Mon Sep 17 00:00:00 2001 From: Wanjun Gu Date: Sun, 25 Oct 2026 10:26:29 -0700 Subject: [PATCH] fix(release): give Windows smoke profiles a private ACL The v1.94.0 Windows release smoke failed: the installed daemon refused to open its session history because the test profile sat under RUNNER_TEMP, which inherits the drive root's "Users may create folders" entry. Private storage refuses a directory another account can write to, so the daemon exited before it served /status. A real profile folder (%APPDATA%) grants only the user, SYSTEM and Administrators. Give the installed and normal smoke roots that same protected ACL. port-release-regression.ps1 already uses the private %TEMP%. Run 40172436472 passed every Windows step against the v1.94.0 draft assets with this change. --- scripts/windows/installed-release-smoke.ps1 | 12 ++++++++++++ scripts/windows/normal-release-smoke.ps1 | 12 ++++++++++++ 2 files changed, 24 insertions(+) diff --git a/scripts/windows/installed-release-smoke.ps1 b/scripts/windows/installed-release-smoke.ps1 index 019693d84..65d5f3cbc 100644 --- a/scripts/windows/installed-release-smoke.ps1 +++ b/scripts/windows/installed-release-smoke.ps1 @@ -97,6 +97,18 @@ function Stop-OwnedProcess { } try { + # A real profile folder is private to its account. RUNNER_TEMP inherits the + # drive root's "Users may create folders" entry, which private storage refuses. + New-Item -ItemType Directory -Path $root -Force | Out-Null + $rootAcl = [Security.AccessControl.DirectorySecurity]::new() + $rootAcl.SetAccessRuleProtection($true, $false) + foreach ($sid in @([Security.Principal.WindowsIdentity]::GetCurrent().User, + [Security.Principal.SecurityIdentifier]::new('S-1-5-18'), + [Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'))) { + $rootAcl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new($sid, 'FullControl', + 'ContainerInherit,ObjectInherit', 'None', 'Allow')) + } + Set-Acl -LiteralPath $root -AclObject $rootAcl New-Item -ItemType Directory -Path $local, (Join-Path $root 'roaming'), (Join-Path $root 'electron') -Force | Out-Null $result.assets = @(Get-Content -LiteralPath $AssetEvidence -Raw | ConvertFrom-Json) if ($result.assets.Count -ne 2) { throw 'Expected authenticated ZIP and Setup asset evidence' } diff --git a/scripts/windows/normal-release-smoke.ps1 b/scripts/windows/normal-release-smoke.ps1 index e2ab66ef3..4c39ebab0 100644 --- a/scripts/windows/normal-release-smoke.ps1 +++ b/scripts/windows/normal-release-smoke.ps1 @@ -210,6 +210,18 @@ $expression = @' '@ try { + # A real profile folder is private to its account. RUNNER_TEMP inherits the + # drive root's "Users may create folders" entry, which private storage refuses. + New-Item -ItemType Directory -Path $root -Force | Out-Null + $rootAcl = [Security.AccessControl.DirectorySecurity]::new() + $rootAcl.SetAccessRuleProtection($true, $false) + foreach ($sid in @([Security.Principal.WindowsIdentity]::GetCurrent().User, + [Security.Principal.SecurityIdentifier]::new('S-1-5-18'), + [Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'))) { + $rootAcl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new($sid, 'FullControl', + 'ContainerInherit,ObjectInherit', 'None', 'Allow')) + } + Set-Acl -LiteralPath $root -AclObject $rootAcl New-Item -ItemType Directory -Force -Path $normalUserDataDirectory, (Join-Path $root 'local'), (Join-Path $root 'roaming'), (Join-Path $root 'home'), (Split-Path -Parent $Report) | Out-Null $result.assets = @(Get-Content -LiteralPath $AssetEvidence -Raw | ConvertFrom-Json)