{"record":{"id":"e9ee55d73874a4b1","repo":"astrid-runtime/astrid","slug":"private-windows-path-has-a-null-dacl-description","errorCode":null,"errorMessage":"private Windows path has a null DACL: {description}","messagePattern":"private Windows path has a null DACL: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-core/src/platform_fs/windows/acl.rs","lineNumber":442,"sourceCode":"    let status = unsafe {\n        GetNamedSecurityInfoW(\n            wide.as_ptr(),\n            SE_FILE_OBJECT,\n            OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,\n            &raw mut owner,\n            null_mut(),\n            &raw mut dacl,\n            null_mut(),\n            &raw mut descriptor,\n        )\n    };\n    if status != ERROR_SUCCESS {\n        return Err(io::Error::from_raw_os_error(status.cast_signed()));\n    }\n    let allocation = LocalAllocation(descriptor);\n    let description = path.display().to_string();\n    let result = if dacl.is_null() {\n        Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            format!(\"private Windows path has a null DACL: {description}\"),\n        ))\n    } else {\n        // SAFETY: GetNamedSecurityInfoW returned `dacl` inside the descriptor\n        // allocation retained by `allocation`.\n        unsafe { ValidatedAcl::from_raw(dacl, &allocation, &description) }.and_then(|acl| {\n            validate_private_acl_parts(\n                &required,\n                owner,\n                &acl,\n                descriptor,\n                is_directory,\n                &description,\n            )\n        })\n    };\n    drop(allocation);","sourceCodeStart":424,"sourceCodeEnd":460,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/platform_fs/windows/acl.rs#L424-L460","documentation":"When validating that a private Windows path (created by this library with a protected DACL limited to the current user, LOCAL_SYSTEM, and Administrators) is actually secure, the library queries the path's security descriptor via GetNamedSecurityInfoW. A null DACL means the object grants everyone full access, so the library refuses it with io::ErrorKind::PermissionDenied rather than continue with an insecure path.","triggerScenarios":"Calling private_temp (or anything that calls validate_private_acl) on a Windows path whose security descriptor has no DACL — e.g. the path was created outside the library, or its DACL was removed/replaced after creation.","commonSituations":"An external tool or script (icacls reset, backup/restore tools, security policy) rewrote the ACL of the private temp directory; mixing library-created private dirs with third-party file managers; restoring files from a backup that dropped the DACL.","solutions":["Delete the affected private directory and let the library recreate it, so it gets a correct protected DACL.","Restore the intended ACL manually, e.g. `icacls <path> /inheritance:r /grant:r \"%USERNAME%\":F` plus SYSTEM/Administrators as needed.","Check what process modified the ACL (Event Viewer / audit policy) and stop it from touching private directories.","Ensure you pass a path that the library created, not a pre-existing user-writable folder."],"exampleFix":"// before: reusing a pre-existing directory with a wiped DACL\nlet dir = std::path::Path::new(\"C:\\\\app\\\\tmp\");\nprivate_temp(dir)?;\n\n// after: let the library create its own private directory\nlet dir = private_temp(std::env::temp_dir())?;","handlingStrategy":"validation","validationCode":"// Pre-check the DACL before handing a path to the library (PowerShell):\n// $acl = Get-Acl C:\\app\\tmp\n// if (-not $acl.AreAccessRulesProtected) { Remove-Item -Recurse C:\\app\\tmp }\n// if ($acl.Access.Count -eq 0) { Remove-Item -Recurse C:\\app\\tmp }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always let the library create its private directories; never reuse arbitrary pre-existing folders.","Keep backup/sync/AV tools away from the private root or exclude it from ACL rewrites.","Use NTFS volumes only; never place private roots on FAT32/exFAT/network shares.","If a validation error occurs, delete the directory and recreate it via the library."],"tags":["windows","acl","security","permissions"],"backgroundTag":"permission-denied","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}