Joseph Doherty
2a8e2981fe
v2-ci / unit-tests (push) Has been cancelled
feat(scripting): ScriptWorker isolation on Windows: restricted worker identity, pipe ACL, firewall + PeCacheDir installer (lmxopcua#780)
...
Owner decisions §14 #5/#6 as built (design §12.5):
- Scripting:Worker:Identity (default unset, Windows only, fail-closed validation): each worker
starts under a restricted token derived from the host's. Every privilege but SeChangeNotify is
removed; the restricting SIDs are NT SERVICE\OtOpcUaScriptWorker's SID + Everyone + Users +
RESTRICTED; the token and default DACLs are host + SYSTEM + identity + RESTRICTED. The worker
is created suspended, put in its Job Object before it runs, inherits only its stdio pipes, gets
an ACL'd work dir as TEMP, and runs with DOTNET_EnableDiagnostics=0. The identity is granted on
the host's window station and desktop, because USER32 init made coreclr.dll fail with
ERROR_DLL_INIT_FAILED on windev. The logon SID is not used because the host's process DACL
gives it PROCESS_VM_READ.
- The worker pipe on Windows always has an explicit protected DACL: host account + identity
only. There is no owner ACE, so an elevated host's Administrators gets no access.
- The worker treats access denied on its parent-pid poll as alive; the Job Object covers that case.
- scripts/install/Install-ScriptWorkerIsolation.ps1 + ScriptWorkerIsolation.psm1 are idempotent
and support -WhatIf, -Uninstall and -PlanOnly. They create the disabled anchor service, the
PeCacheDir ACL (protected, no Users, key and markers host-only, pe\ Modify for the identity),
read+execute on script-worker\, a ReadData deny on the install root, the outbound firewall
block on the worker exe, and optionally the host-service env.
- Tests: the dry-run harness scripts/install/tests/Test-ScriptWorkerIsolation.ps1 (46
assertions, mutation-checked); ScriptWorkerIdentityTests; WorkerIsolationTests, which cover
the pipe ACL, token access and a real restricted worker running a script, all green on windev.
Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
2026-11-10 08:46:23 -05:00
..
2026-10-09 06:16:16 -04:00
2026-06-15 09:52:51 -04:00
2026-08-07 02:02:54 -04:00
2026-06-18 09:24:35 -04:00
2026-08-10 04:29:49 -04:00
2026-06-15 09:52:51 -04:00
2026-08-07 06:28:22 -04:00
2026-06-15 09:52:51 -04:00
2026-06-03 13:59:02 -04:00
2026-06-03 14:06:24 -04:00
2026-06-15 09:52:51 -04:00
2026-06-07 06:08:36 -04:00
2026-06-06 14:20:36 -04:00
2026-06-06 15:07:45 -04:00
2026-06-07 04:49:27 -04:00
2026-06-07 06:09:23 -04:00
2026-06-07 10:06:08 -04:00
2026-06-07 10:20:52 -04:00
2026-06-07 10:56:27 -04:00
2026-06-07 02:50:49 -04:00
2026-06-07 02:59:46 -04:00
2026-06-16 18:51:49 -04:00
2026-06-07 14:55:28 -04:00
2026-06-07 15:00:11 -04:00
2026-06-07 15:57:43 -04:00
2026-06-08 06:49:28 -04:00
2026-06-08 06:49:28 -04:00
2026-06-08 07:10:14 -04:00
2026-06-08 12:02:18 -04:00
2026-06-08 12:11:40 -04:00
2026-06-15 09:52:51 -04:00
2026-06-09 09:03:22 -04:00
2026-06-09 09:11:02 -04:00
2026-06-15 09:52:51 -04:00
2026-06-09 13:44:20 -04:00
2026-11-09 17:44:35 -05:00
2026-06-09 15:52:57 -04:00
2026-06-10 07:27:44 -04:00
2026-06-10 07:36:59 -04:00
2026-06-15 09:52:51 -04:00
2026-06-10 11:28:13 -04:00
2026-06-11 05:37:54 -04:00
2026-06-11 08:08:37 -04:00
2026-06-11 04:19:43 -04:00
2026-06-11 04:24:00 -04:00
2026-06-11 05:37:54 -04:00
2026-06-11 08:23:58 -04:00
2026-06-11 10:51:55 -04:00
2026-06-11 10:56:25 -04:00
2026-06-15 09:52:51 -04:00
2026-06-11 08:28:37 -04:00
2026-06-15 09:52:51 -04:00
2026-06-11 12:42:54 -04:00
2026-06-15 09:52:51 -04:00
2026-06-11 20:22:32 -04:00
2026-06-11 20:31:17 -04:00
2026-06-15 09:52:51 -04:00
2026-06-11 14:03:21 -04:00
2026-06-11 14:13:25 -04:00
2026-06-11 15:42:38 -04:00
2026-06-12 20:55:08 -04:00
2026-06-12 21:05:45 -04:00
2026-06-15 09:52:51 -04:00
2026-06-12 11:03:32 -04:00
2026-06-12 11:10:41 -04:00
2026-07-27 19:54:41 -04:00
2026-06-13 06:21:40 -04:00
2026-06-13 06:24:38 -04:00
2026-06-15 09:52:51 -04:00
2026-06-13 08:11:41 -04:00
2026-06-13 08:14:04 -04:00
2026-06-13 09:37:20 -04:00
2026-06-13 10:45:25 -04:00
2026-06-13 10:51:18 -04:00
2026-06-13 12:44:29 -04:00
2026-06-14 17:08:24 -04:00
2026-06-14 17:11:07 -04:00
2026-08-07 06:28:22 -04:00
2026-06-14 02:50:34 -04:00
2026-06-14 02:58:12 -04:00
2026-06-15 09:52:51 -04:00
2026-06-14 18:46:43 -04:00
2026-06-14 18:48:33 -04:00
2026-06-15 09:52:51 -04:00
2026-06-14 00:51:05 -04:00
2026-06-14 00:51:05 -04:00
2026-06-14 22:38:42 -04:00
2026-06-15 09:52:51 -04:00
2026-06-14 01:13:38 -04:00
2026-06-15 05:57:15 -04:00
2026-06-15 09:52:51 -04:00
2026-06-15 10:43:29 -04:00
2026-06-15 09:40:03 -04:00
2026-07-27 19:54:41 -04:00
2026-06-15 12:33:09 -04:00
2026-06-15 12:41:51 -04:00
2026-07-27 19:54:41 -04:00
2026-10-13 09:07:13 -04:00
2026-06-15 14:05:00 -04:00
2026-07-27 19:54:41 -04:00
2026-06-16 05:18:19 -04:00
2026-06-16 05:21:00 -04:00
2026-07-27 19:54:41 -04:00
2026-06-16 19:17:19 -04:00
2026-06-16 19:23:03 -04:00
2026-07-27 19:54:41 -04:00
2026-06-16 21:06:59 -04:00
2026-06-16 21:10:50 -04:00
2026-07-27 19:54:41 -04:00
2026-06-16 07:12:48 -04:00
2026-06-16 06:32:15 -04:00
2026-06-16 07:35:17 -04:00
2026-06-16 16:09:06 -04:00
2026-06-16 16:11:42 -04:00
2026-06-16 17:32:12 -04:00
2026-06-16 17:47:25 -04:00
2026-06-16 17:51:56 -04:00
2026-06-16 18:41:30 -04:00
2026-06-17 19:52:52 -04:00
2026-06-17 20:00:05 -04:00
2026-06-17 20:51:55 -04:00
2026-06-17 11:44:14 -04:00
2026-06-17 11:51:29 -04:00
2026-06-17 12:14:56 -04:00
2026-06-17 05:15:42 -04:00
2026-06-17 05:17:50 -04:00
2026-06-17 06:37:37 -04:00
2026-06-18 04:59:52 -04:00
2026-06-18 05:01:29 -04:00
2026-06-18 05:24:18 -04:00
2026-06-18 08:47:12 -04:00
2026-06-18 09:07:33 -04:00
2026-06-18 09:24:35 -04:00
2026-06-18 13:30:01 -04:00
2026-06-18 13:31:10 -04:00
2026-06-18 14:02:47 -04:00
2026-06-18 12:59:51 -04:00
2026-06-18 13:00:54 -04:00
2026-06-18 13:14:50 -04:00
2026-06-18 12:17:13 -04:00
2026-06-18 12:19:45 -04:00
2026-06-18 12:48:52 -04:00
2026-06-18 04:11:24 -04:00
2026-06-18 04:13:51 -04:00
2026-06-18 04:35:14 -04:00
2026-06-18 11:26:09 -04:00
2026-06-18 11:29:58 -04:00
2026-06-18 12:02:15 -04:00
2026-06-18 05:55:58 -04:00
2026-06-18 06:00:01 -04:00
2026-06-18 06:19:47 -04:00
2026-06-18 02:30:58 -04:00
2026-06-18 02:34:45 -04:00
2026-06-18 02:54:20 -04:00
2026-07-13 09:53:01 -04:00
2026-06-19 00:23:32 -04:00
2026-06-19 00:26:30 -04:00
2026-06-19 00:54:32 -04:00
2026-06-19 01:19:37 -04:00
2026-08-10 05:48:09 -04:00
2026-08-10 05:48:09 -04:00
2026-06-25 16:41:42 -04:00
2026-06-25 17:04:44 -04:00
2026-06-26 09:11:40 -04:00
2026-06-26 15:19:46 -04:00
2026-06-26 15:19:46 -04:00
2026-06-26 09:11:40 -04:00
2026-06-26 09:11:40 -04:00
2026-06-26 15:19:46 -04:00
2026-06-26 15:19:46 -04:00
2026-08-10 04:29:49 -04:00
2026-06-26 16:09:29 -04:00
2026-07-25 15:34:31 -04:00
2026-07-27 19:54:41 -04:00
2026-07-13 09:53:01 -04:00
2026-06-27 02:00:09 -04:00
2026-07-15 16:54:09 -04:00
2026-07-15 16:50:30 -04:00
2026-08-05 03:14:31 -04:00
2026-07-15 16:54:09 -04:00
2026-11-09 13:58:38 -05:00
2026-08-05 06:55:14 -04:00
2026-07-15 16:54:09 -04:00
2026-07-15 16:50:30 -04:00
2026-11-09 22:59:09 -05:00
2026-07-15 17:42:42 -04:00
2026-08-05 04:32:38 -04:00
2026-07-15 18:14:03 -04:00
2026-07-15 22:05:19 -04:00
2026-07-15 16:50:30 -04:00
2026-07-15 16:50:30 -04:00
2026-07-15 16:50:30 -04:00
2026-07-15 16:50:30 -04:00
2026-07-15 16:50:30 -04:00
2026-07-16 05:27:31 -04:00
2026-07-16 07:38:20 -04:00
2026-07-31 12:00:17 -04:00
2026-07-17 16:07:55 -04:00
2026-07-20 10:18:01 -04:00
2026-07-20 23:15:21 -04:00
2026-07-21 03:46:56 -04:00
2026-07-21 06:13:01 -04:00
2026-07-21 02:14:00 -04:00
2026-08-07 02:02:54 -04:00
2026-07-20 10:46:07 -04:00
2026-08-07 02:02:54 -04:00
2026-07-21 05:03:57 -04:00
2026-08-07 02:02:54 -04:00
2026-07-21 02:40:14 -04:00
2026-08-07 02:02:54 -04:00
2026-07-22 09:07:29 -04:00
2026-07-22 09:07:48 -04:00
2026-07-22 09:07:29 -04:00
2026-07-22 18:40:42 -04:00
2026-07-22 18:40:42 -04:00
2026-08-07 02:02:54 -04:00
2026-07-22 19:00:36 -04:00
2026-07-22 20:48:58 -04:00
2026-07-22 20:48:58 -04:00
2026-07-24 08:01:26 -04:00
2026-07-27 19:54:41 -04:00
2026-08-01 11:09:57 -04:00
2026-07-22 07:19:34 -04:00
2026-07-23 12:06:42 -04:00
2026-07-27 19:54:41 -04:00
2026-07-23 14:03:28 -04:00
2026-07-23 14:56:20 -04:00
2026-07-23 17:11:52 -04:00
2026-07-23 17:11:52 -04:00
2026-08-05 07:28:29 -04:00
2026-07-24 07:08:52 -04:00
2026-07-24 02:39:08 -04:00
2026-07-24 07:08:52 -04:00
2026-07-24 08:35:16 -04:00
2026-07-24 13:17:44 -04:00
2026-07-27 19:54:41 -04:00
2026-07-24 13:17:44 -04:00
2026-07-27 19:54:41 -04:00
2026-07-27 13:59:26 -04:00
2026-07-27 19:54:41 -04:00
2026-07-24 13:17:44 -04:00
2026-07-27 19:54:41 -04:00
2026-08-07 02:02:54 -04:00
2026-08-07 02:02:54 -04:00
2026-08-05 07:14:55 -04:00
2026-08-05 06:08:44 -04:00
2026-08-05 07:14:55 -04:00
2026-08-09 21:07:07 -04:00
2026-08-05 03:19:04 -04:00
2026-08-05 04:32:53 -04:00
2026-08-06 02:12:44 -04:00
2026-08-05 07:55:12 -04:00
2026-08-07 02:02:54 -04:00
2026-08-05 07:28:52 -04:00
2026-08-06 02:44:11 -04:00
2026-08-06 20:29:05 -04:00
2026-08-07 02:02:54 -04:00
2026-08-06 09:24:16 -04:00
2026-08-07 02:02:54 -04:00
2026-08-08 05:45:08 -04:00
2026-08-07 06:08:50 -04:00
2026-08-10 17:56:27 -04:00
2026-08-10 16:26:56 -04:00
2026-08-17 04:42:51 -04:00
2026-10-08 08:16:43 -04:00
2026-08-15 20:01:37 -04:00
2026-08-15 18:02:21 -04:00
2026-08-15 13:10:55 -04:00
2026-08-15 13:10:55 -04:00
2026-08-18 08:48:40 -04:00
2026-08-17 06:11:36 -04:00
2026-08-18 10:01:48 -04:00
2026-10-08 08:16:43 -04:00
2026-08-17 06:11:20 -04:00
2026-08-17 04:43:09 -04:00
2026-10-07 14:35:14 -04:00
2026-10-09 06:41:14 -04:00
2026-10-07 15:24:25 -04:00
2026-10-07 21:14:44 -04:00
2026-10-08 06:52:41 -04:00
2026-10-09 14:33:45 -04:00
2026-10-09 15:14:46 -04:00
2026-10-09 12:40:35 -04:00
2026-10-11 03:09:11 -04:00
2026-11-06 15:31:43 -05:00
2026-10-10 09:09:42 -04:00
2026-10-10 09:09:42 -04:00
2026-10-11 01:10:31 -04:00
2026-10-11 08:14:38 -04:00
2026-10-11 10:39:01 -04:00
2026-10-13 07:10:58 -04:00
2026-10-13 05:21:46 -04:00
2026-10-13 04:31:52 -04:00
2026-10-13 03:51:04 -04:00
2026-10-13 06:30:08 -04:00
2026-11-09 20:32:50 -05:00
2026-11-10 08:46:23 -05:00
2026-07-15 15:23:32 -04:00
2026-07-15 15:23:32 -04:00
2026-08-07 02:02:54 -04:00
2026-11-09 12:30:03 -05:00
2026-08-07 02:02:54 -04:00