From c494f33526a7865741555a2c1df034a66213e2e2 Mon Sep 17 00:00:00 2001 From: PYTHONRETARDE <152398455+PYTHONRETARDE@users.noreply.github.com> Date: Thu, 15 Oct 2026 00:18:40 +0000 Subject: [PATCH] test(libkernel): deny the kqueue parent listing to the token user's SID DeniedParentWatch denied FILE_LIST_DIRECTORY to the name GetUserNameW returns. When the user name equals the computer name, LookupAccountNameW resolves that bare name to the computer's domain SID (SidTypeDomain), so the deny entry matched no one, the parent watch was allowed and the test aborted on an empty error. The entry now names the SID of the process token's user. Co-Authored-By: Claude Opus 5.5 --- core/libs/tests/GuestKqueue.cpp | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/core/libs/tests/GuestKqueue.cpp b/core/libs/tests/GuestKqueue.cpp index 8ac99378e5..e2721ab46d 100644 --- a/core/libs/tests/GuestKqueue.cpp +++ b/core/libs/tests/GuestKqueue.cpp @@ -9,6 +9,7 @@ #include #include #include +#include #ifdef _WIN32 #include #include @@ -447,9 +448,14 @@ static std::string Utf8(const std::wstring& text) { } static PACL DenyListing(const std::wstring& directory, PSECURITY_DESCRIPTOR& owner) { - wchar_t account[256]{}; - DWORD count = static_cast(sizeof(account) / sizeof(account[0])); - Require(::GetUserNameW(account, &count) != FALSE); + HANDLE token = nullptr; + Require(::OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY, &token) != FALSE); + DWORD size = 0; + ::GetTokenInformation(token, TokenUser, nullptr, 0, &size); + std::vector user(size); + const BOOL queried = ::GetTokenInformation(token, TokenUser, user.data(), size, &size); + ::CloseHandle(token); + Require(queried != FALSE); PACL original = nullptr; Require(::GetNamedSecurityInfoW(directory.c_str(), SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, nullptr, nullptr, &original, nullptr, &owner) == ERROR_SUCCESS); @@ -457,9 +463,9 @@ static PACL DenyListing(const std::wstring& directory, PSECURITY_DESCRIPTOR& own denied.grfAccessPermissions = FILE_LIST_DIRECTORY; denied.grfAccessMode = DENY_ACCESS; denied.grfInheritance = NO_INHERITANCE; - denied.Trustee.TrusteeForm = TRUSTEE_IS_NAME; + denied.Trustee.TrusteeForm = TRUSTEE_IS_SID; denied.Trustee.TrusteeType = TRUSTEE_IS_USER; - denied.Trustee.ptstrName = account; + denied.Trustee.ptstrName = static_cast(reinterpret_cast(user.data())->User.Sid); PACL blocked = nullptr; Require(::SetEntriesInAclW(1, &denied, original, &blocked) == ERROR_SUCCESS); const DWORD applied = ::SetNamedSecurityInfoW(const_cast(directory.c_str()), SE_FILE_OBJECT,