{"record":{"id":"dcc74891fd67aeb7","repo":"astrid-runtime/astrid","slug":"permissiondenied","errorCode":"PermissionDenied","errorMessage":"trusted Windows parent has an untrusted owner: {description}","messagePattern":"trusted Windows parent has an untrusted owner: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-core/src/platform_fs/windows/acl.rs","lineNumber":648,"sourceCode":"        // SAFETY: GetSecurityInfo returned `dacl` inside the descriptor\n        // allocation retained by `allocation`.\n        unsafe { ValidatedAcl::from_raw(dacl, &allocation, description) }.and_then(|acl| {\n            validate_trusted_parent_acl_parts(&required, owner, &acl, dangerous_access, description)\n        })\n    };\n    drop(allocation);\n    result\n}\n\nfn validate_trusted_parent_acl_parts(\n    required: &RequiredSids,\n    owner: PSID,\n    acl: &ValidatedAcl<'_>,\n    dangerous_access: u32,\n    description: &str,\n) -> io::Result<()> {\n    if !required.is_trusted(owner) {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            format!(\"trusted Windows parent has an untrusted owner: {description}\"),\n        ));\n    }\n\n    for index in 0..acl.ace_count() {\n        let (flags, mask, sid) = match acl.ace(index)? {\n            ValidatedAce::Allow { flags, mask, sid } => (flags, mask, sid),\n            ValidatedAce::Deny { .. } => continue,\n            ValidatedAce::Unsupported { ace_type, .. } => {\n                return Err(io::Error::new(\n                    io::ErrorKind::PermissionDenied,\n                    format!(\n                        \"trusted Windows parent has unsupported ACE type {ace_type}: {description}\"\n                    ),\n                ));\n            },\n        };","sourceCodeStart":630,"sourceCodeEnd":666,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/platform_fs/windows/acl.rs#L630-L666","documentation":"When validating a trusted Windows parent directory, the library first checks that the directory's owner SID is one of the trusted principals (current user, LOCAL_SYSTEM, or Administrators). If the owner is someone else — another account, a service SID, or TrustedInstaller — the directory could be re-ACLed against the current user by its owner, so validation fails with io::ErrorKind::PermissionDenied.","triggerScenarios":"validate_trusted_parent_acl_parts, invoked through validate_trusted_parent_acl_handle_with_mask during private-directory setup or trusted-parent checks, finds GetSecurityInfo returned an owner SID that RequiredSids::is_trusted rejects.","commonSituations":"The parent folder was created by an installer running as another account, by the SYSTEM service, or by a different logged-in user; directories created under elevated vs non-elevated shells can end up owned by the Administrators group vs the user, depending on UAC token settings; moving/copying folders can change ownership.","solutions":["Take ownership and reassign to the current user: `takeown /f <parent> /r` then `icacls <parent> /setowner \"%USERNAME%\" /t` (elevated).","Delete the parent directory and recreate it under the current account so ownership is correct from the start.","Run the application consistently under the same account that created the private root (avoid mixing elevated/admin and normal sessions).","Use a private root inside the per-user profile (e.g. %LOCALAPPDATA%) instead of a shared location owned by another principal."],"exampleFix":"// before: root created by an elevated installer, owned by Administrators\nC:\\ProgramData\\vendor\\priv\n\n// after: per-user root owned by the current user\n%LOCALAPPDATA%\\vendor\\priv","handlingStrategy":"validation","validationCode":"// Confirm the parent is owned by the current user before use (PowerShell):\n// $acl = Get-Acl C:\\priv-root\n// if ($acl.Owner -ne \"$env:USERDOMAIN\\$env:USERNAME\") {\n//   # recreate the folder under this account, or take ownership elevated:\n//   # takeown /f C:\\priv-root /r ; icacls C:\\priv-root /setowner \"$env:USERNAME\" /t\n// }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Create the private root under the same account the application runs as.","Avoid mixing elevated (admin-token) and normal sessions on the same data directory.","Prefer per-user locations (%LOCALAPPDATA%) over shared ProgramData paths.","After installers create app folders, re-create or re-own the private root before first use."],"tags":["windows","acl","ownership","security","permissions"],"backgroundTag":"permission-denied","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}