{"record":{"id":"f9733641704ce2c4","repo":"astrid-runtime/astrid","slug":"trusted-windows-parent-has-a-null-dacl-descripti","errorCode":null,"errorMessage":"trusted Windows parent has a null DACL: {description}","messagePattern":"trusted Windows parent has a null DACL: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-core/src/platform_fs/windows/acl.rs","lineNumber":625,"sourceCode":"    // valid for the duration of the call.\n    let status = unsafe {\n        GetSecurityInfo(\n            handle,\n            SE_FILE_OBJECT,\n            OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,\n            &raw mut owner,\n            null_mut(),\n            &raw mut dacl,\n            null_mut(),\n            &raw mut descriptor,\n        )\n    };\n    if status != ERROR_SUCCESS {\n        return Err(io::Error::from_raw_os_error(status.cast_signed()));\n    }\n    let allocation = LocalAllocation(descriptor);\n    let result = if dacl.is_null() {\n        Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            format!(\"trusted Windows parent has a null DACL: {description}\"),\n        ))\n    } else {\n        // SAFETY: GetSecurityInfo returned `dacl` inside the descriptor\n        // allocation retained by `allocation`.\n        unsafe { ValidatedAcl::from_raw(dacl, &allocation, description) }.and_then(|acl| {\n            validate_trusted_parent_acl_parts(&required, owner, &acl, dangerous_access, description)\n        })\n    };\n    drop(allocation);\n    result\n}\n\nfn validate_trusted_parent_acl_parts(\n    required: &RequiredSids,\n    owner: PSID,\n    acl: &ValidatedAcl<'_>,","sourceCodeStart":607,"sourceCodeEnd":643,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/platform_fs/windows/acl.rs#L607-L643","documentation":"The library treats its trusted parent directories (e.g. the private base folder) as part of the security boundary: only trusted principals may hold write/delete authority there. Before checking ACEs it reads the parent handle's security descriptor via GetSecurityInfo; if the descriptor has a null DACL (everyone has full control), it raises io::ErrorKind::PermissionDenied with this message.","triggerScenarios":"validate_trusted_parent_acl_handle or validate_trusted_parent_acl_for_create_handle reads a trusted parent directory handle whose security descriptor reports a null DACL.","commonSituations":"The parent directory was created by other software without a DACL, its ACL was reset by icacls/backup tooling, or the directory lives on a filesystem (e.g. FAT32/exFAT) that does not support ACLs.","solutions":["Move the private root to an NTFS volume; ACL-less filesystems (FAT32/exFAT/network shares) cannot pass validation.","Restore a proper DACL on the parent: `icacls <parent> /inheritance:r /grant:r \"%USERNAME%\":F /grant:r SYSTEM:F /grant:r Administrators:F`.","Recreate the parent directory through the library's private-creation path.","Stop backup/sync tools from resetting security descriptors on the private root."],"exampleFix":"// before: private root on a FAT32 volume (no DACL support)\nlet base = \"E:\\\\priv\"; // exFAT USB drive\n\n// after: use an NTFS location\nlet base = \"C:\\\\ProgramData\\\\myapp\\\\priv\";","handlingStrategy":"validation","validationCode":"// Ensure the parent has a real DACL before pointing the library at it (PowerShell):\n// $acl = Get-Acl C:\\priv-root\n// if ($acl.Access.Count -eq 0) { throw \"parent has null DACL - recreate on NTFS\" }\n// (Also confirm the volume is NTFS: Get-Volume -DriveLetter C | Select FileSystem)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Place the trusted parent on an NTFS volume.","Let the library create the parent directory itself rather than pre-creating it with other tooling.","Prevent backup/restore jobs from stripping security descriptors on the parent."],"tags":["windows","acl","security","permissions","filesystem"],"backgroundTag":"permission-denied","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}