{"record":{"id":"102b2352f1682bd8","repo":"rustdesk/rustdesk","slug":"portable-service-shared-memory-acl-file-target-is","errorCode":null,"errorMessage":"Portable service shared-memory ACL file target is a reparse point and is rejected: '{}'","messagePattern":"Portable service shared-memory ACL file target is a reparse point and is rejected: '(.+?)'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/platform/windows/acl.rs","lineNumber":389,"sourceCode":"\nfn set_path_permission_for_portable_service_shmem_impl(\n    path: &Path,\n    expect_dir: bool,\n) -> ResultType<()> {\n    if expect_dir {\n        validate_portable_service_shmem_dir_target(path)?;\n    } else {\n        let metadata_result = fs::symlink_metadata(path);\n        match metadata_result {\n            Ok(metadata) => {\n                if metadata.file_type().is_dir() {\n                    bail!(\n                        \"Portable service shared-memory ACL target is a directory, expected file-like path: '{}'\",\n                        path.display()\n                    );\n                }\n                if is_reparse_point(&metadata) {\n                    bail!(\n                        \"Portable service shared-memory ACL file target is a reparse point and is rejected: '{}'\",\n                        path.display()\n                    );\n                }\n            }\n            Err(e)\n                if e.kind() == io::ErrorKind::NotFound\n                    || e.kind() == io::ErrorKind::PermissionDenied =>\n            {\n                // Keep going and let Win32 ACL APIs return the final OS error.\n                // `Path::exists()/is_file()` and metadata can collapse ACL-denied paths into\n                // a false \"not found\" signal under restricted directory ACLs.\n            }\n            Err(e) => {\n                bail!(\n                    \"Failed to inspect portable service shared-memory ACL target '{}': {}\",\n                    path.display(),\n                    e","sourceCodeStart":371,"sourceCodeEnd":407,"githubUrl":"https://github.com/rustdesk/rustdesk/blob/91c9fccbb0f7bfe5f11644d5fbdec9b23fa10540/src/platform/windows/acl.rs#L371-L407","documentation":"Raised by set_path_permission_for_portable_service_shmem_impl (file variant) when the file target carries the reparse-point attribute. Symlinked or placeholder file targets are rejected because applying a protected DACL would hit the reparse target or the link inconsistently, which is a security hazard for shared memory.","triggerScenarios":"Calling set_path_permission_for_portable_service_shmem_file(path) where symlink_metadata shows path is a symlink, or where the file is a OneDrive/Dev Drive placeholder with FILE_ATTRIBUTE_REPARSE_POINT.","commonSituations":"The shmem file path is a symlink created for testing (fs::symlink_file); the file lives in a cloud-synced folder that placeholders its contents; a junctioned directory redirects to the file.","solutions":["Use the real (non-link) file path; resolve the symlink before applying the ACL.","Move the file out of the synced/placeholder location into a plain NTFS directory.","If a test needs a reparse target, update the test to use a real file, matching the function's contract."],"exampleFix":"// before\nset_path_permission_for_portable_service_shmem_file(&link_path)?;\n// after\nlet real = fs::read_link(&link_path)?;\nset_path_permission_for_portable_service_shmem_file(&real)?;","handlingStrategy":"validation","validationCode":"let m = std::fs::symlink_metadata(&file_path)?;\nif m.is_dir() || m.is_symlink() {\n    return Err(anyhow!(\"reparse/dir target rejected: {}\", file_path.display()));\n}","typeGuard":"fn is_plain_file(p: &Path) -> bool {\n    matches!(std::fs::symlink_metadata(p), Ok(m) if !m.is_dir() && !m.is_symlink())\n}","tryCatchPattern":"if let Err(e) = set_path_permission_for_portable_service_shmem_file(&p) {\n    if e.to_string().contains(\"reparse point\") {\n        let real = std::fs::read_link(&p).unwrap_or(p.to_path_buf());\n        set_path_permission_for_portable_service_shmem_file(&real)?;\n    } else { return Err(e); }\n}","preventionTips":["Do not symlink shmem files in production deployments","Keep shmem files out of cloud-synced/placeholder directories","Resolve links with fs::read_link before ACL operations"],"tags":["windows","acl","symlink","security"],"backgroundTag":"unsupported-operation","analyzedSha":"91c9fccbb0f7bfe5f11644d5fbdec9b23fa10540","analyzedAt":"2026-09-10T19:53:44.083Z","contentChangedAt":"2026-09-10T19:53:44.083Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}