fix(windows): add Users and Authenticated Users SIDs to restricted token SIDs#640

Open

euxaristia wants to merge 9 commits into

Gitlawb:mainfrom

euxaristia:fix/windows-sandbox-restricted-token-sids

Commits on Jul 17, 2026

fix(windows): add Users and Authenticated Users SIDs to restricted token SIDs
euxaristia
committed
fix(sandbox): add DenyWrite ACEs for system drive, ProgramData, and Windows Temp
euxaristia
committed
fix(sandbox): scope broadened restricted-token SIDs to the elevated tier
euxaristia
committed
fix(sandbox): fail loudly on unexpected ProgramData marker stat errors
euxaristia
committed
fix(windows): resolve deny-paths from trusted APIs and stop ACL inheritance propagation
euxaristia
committed
fix(sandbox): scope SID broadening to fully restricted tokens, stable deny identity
euxaristia
committed
fix(sandbox): include NoInherit in the ACL entry dedupe key
euxaristia
committed
fix(sandbox): deny existing writable descendants of shared deny roots
euxaristia
committed

Commits on Jul 18, 2026

fix(sandbox): correct object-ACE parsing, scan files, and skip write-root-nested shared paths

euxaristia
and
claude
committed