{"record":{"id":"0b9db43d1e3840f6","repo":"Hmbown/CodeWhale","slug":"codewhale-owned-credential-file-dacl-must-grant-on","errorCode":null,"errorMessage":"Codewhale-owned credential file DACL must grant only one user","messagePattern":"Codewhale-owned credential file DACL must grant only one user","errorType":"exception","errorClass":"std::io::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/external_credentials.rs","lineNumber":500,"sourceCode":"        ));\n    }\n    if dacl.is_null() {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            \"Codewhale-owned credential file must have an owner-only DACL\",\n        ));\n    }\n    let mut count = 0;\n    let mut entries: *mut EXPLICIT_ACCESS_W = std::ptr::null_mut();\n    // SAFETY: `dacl` is owned by the live security descriptor; Windows\n    // allocates the returned entries, released below.\n    let result = unsafe { GetExplicitEntriesFromAclW(dacl, &mut count, &mut entries) };\n    if result != ERROR_SUCCESS {\n        return Err(io::Error::from_raw_os_error(result as i32));\n    }\n    let _entries = WindowsLocalAllocation(entries.cast());\n    if count != 1 || entries.is_null() {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            \"Codewhale-owned credential file DACL must grant only one user\",\n        ));\n    }\n    // SAFETY: `count == 1` proves the first returned entry is initialized.\n    let entry = unsafe { &*entries };\n    let trustee_sid: PSID = entry.Trustee.ptstrName.cast();\n    let current_user_only = entry.Trustee.TrusteeForm == TRUSTEE_IS_SID\n        && !trustee_sid.is_null()\n        && unsafe { EqualSid(trustee_sid, user.sid()) } != 0\n        && matches!(entry.grfAccessMode, SET_ACCESS | GRANT_ACCESS)\n        && entry.grfAccessPermissions == FILE_ALL_ACCESS;\n    if !current_user_only {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            \"Codewhale-owned credential file DACL is not current-user-only\",\n        ));\n    }","sourceCodeStart":482,"sourceCodeEnd":518,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/external_credentials.rs#L482-L518","documentation":"Windows DACL check in verify_windows_owner_only_handle: the credential file has no DACL at all, so the required owner-only access policy cannot be verified — the file is rejected with PermissionDenied.","triggerScenarios":"Thrown at crates/tui/src/external_credentials.rs:500 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Restore an owner-only DACL on the file (icacls granting only the current user access).","Re-run the credential creation flow so the tool recreates the file with the proper ACL.","Check the parent directory's ACL inheritance settings."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}