{"record":{"id":"358cb89b4fc65847","repo":"astrid-runtime/astrid","slug":"private-windows-path-acl-is-not-restricted-to-the","errorCode":null,"errorMessage":"private Windows path ACL is not restricted to the current user and required system principals: {description}","messagePattern":"private Windows path ACL is not restricted to the current user and required system principals: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-core/src/platform_fs/windows/acl.rs","lineNumber":538,"sourceCode":") -> io::Result<()> {\n    let mut control = 0_u16;\n    let mut revision = 0_u32;\n    // SAFETY: `descriptor` is the live descriptor returned above and both\n    // output pointers are valid.\n    if unsafe { GetSecurityDescriptorControl(descriptor, &raw mut control, &raw mut revision) } == 0\n    {\n        return Err(io::Error::last_os_error());\n    }\n    let dacl_is_protected = control & SE_DACL_PROTECTED != 0;\n    let owner_is_allowed = required.classify(owner) != AclPrincipal::Other;\n\n    let mut rules = Vec::with_capacity(usize::try_from(acl.ace_count()).unwrap_or_default());\n    for index in 0..acl.ace_count() {\n        rules.push(private_acl_rule(required, acl.ace(index)?, is_directory));\n    }\n\n    if !acl_rules_are_private(is_directory, dacl_is_protected, owner_is_allowed, &rules) {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            format!(\n                \"private Windows path ACL is not restricted to the current user and required system principals: {description}\"\n            ),\n        ));\n    }\n    Ok(())\n}\n\nfn private_acl_rule(required: &RequiredSids, ace: ValidatedAce<'_>, is_directory: bool) -> AclRule {\n    let invalid = || AclRule {\n        principal: AclPrincipal::Other,\n        access: AclAccess::Other,\n        inheritance: AclInheritance::InheritedOrOther,\n    };\n    let ValidatedAce::Allow { flags, mask, sid } = ace else {\n        return invalid();\n    };","sourceCodeStart":520,"sourceCodeEnd":556,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/platform_fs/windows/acl.rs#L520-L556","documentation":"After reading the DACL of a private Windows path or handle, the library compares every ACE against its expectation: the ACL must be protected, have a user-owner allow entry, and be restricted to exactly the current user plus the required system principals (LOCAL_SYSTEM, Administrators). If acl_rules_are_private determines the ACL deviates — extra grantees, missing entries, unprotected/inherited ACL, wrong access bits — it raises io::ErrorKind::PermissionDenied.","triggerScenarios":"validate_private_acl or validate_private_acl_handle finds the ACL of a private directory/file does not match the expected shape: another user or group was granted access, inheritance was re-enabled (SE_DACL_PROTECTED cleared), or an allow rule grants more access than the template.","commonSituations":"Admins or scripts ran `icacls /grant` or `/inheritance:e` on the private temp folder; corporate GPO security policies apply inherited ACLs to temp directories; antivirus/quarantine tools rewrote the ACL; the folder was shared over the network, adding Everyone access.","solutions":["Delete the private directory/file and recreate it via the library so it receives the canonical protected ACL.","Fix the ACL to the expected shape: `icacls <path> /inheritance:r /grant:r \"%USERNAME%\":F /grant:r SYSTEM:F /grant:r Administrators:F`.","Audit group policy / folder-redirection settings that apply inherited ACLs to the temp location; relocate private dirs to a location not governed by those policies.","Identify and exclude the tool (backup, AV, sync client) that modifies the ACL."],"exampleFix":"// before: private dir exposed to a group\n// icacls C:\\priv /grant Users:F  (breaks validation)\n\n// after: restore the restricted ACL\n// icacls C:\\priv /inheritance:r /grant:r \"%USERNAME%\":F /grant:r SYSTEM:F /grant:r Administrators:F","handlingStrategy":"validation","validationCode":"// Verify expected grantees before use (PowerShell):\n// $acl = Get-Acl C:\\priv\n// $names = $acl.Access | ForEach-Object { $_.IdentityReference.Value }\n// if ($names -notmatch '^(<USER>|NT AUTHORITY\\\\SYSTEM|BUILTIN\\\\Administrators)$') {\n//   Reset-Acl C:\\priv\n// }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never run icacls /grant on the private root for extra users or groups.","Watch for group policies that apply inherited or audited ACLs to the temp location; relocate if needed.","Delete-and-recreate via the library is the reliable recovery when an ACL drifts.","Audit periodically that the directory's rules match only user/SYSTEM/Administrators."],"tags":["windows","acl","security","permissions","audit"],"backgroundTag":"permission-denied","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}