mirror of
https://github.com/lahfir/agent-desktop.git
synced 2026-07-29 18:29:20 +00:00
69371f92f3
Reverses the ancestor-walk decision on measurement. A plain leaf under the user profile already inherits SYSTEM, Administrators and the user with no Users entry, all inherited and none explicit, so the walk would verify a property Windows already guarantees. Unix has to author its permission because the default there is world-readable; Windows does not, because the default is already private. The only principal the walk would additionally exclude is another administrator, who holds SeTakeOwnershipPrivilege and can seize any object whatever its DACL. Building a chain-walking validator against someone who can bypass it costs more than it buys, and the cost is specific: parsing ACEs is what the previous layer did, and its AceSize handling is the defect that took the layer down. Removing the parser removes the bug class rather than fixing it, so no successor module exists and a test asserts the ACE symbols never come back. What survives is the control with real unix parity and a real attack behind it: per-component reparse-point rejection. That is an integrity control, not a confidentiality one -- a junction planted on the path redirects where the product writes, which no permission on the intended destination prevents. Cross-admin isolation is now answered rather than open: out of scope, for the same reason macOS never raised the question. |
||
|---|---|---|
| .. | ||
| brainstorms | ||
| plans | ||
| solutions | ||
| architecture.excalidraw | ||
| architecture.html | ||
| architecture.png | ||
| example.html | ||
| example.png | ||
| faq.md | ||
| json-output.md | ||
| phases.md | ||
