24 lines
929 B
Python
24 lines
929 B
Python
"""Keep private Windows temporary directories accessible to this AppContainer.
|
|
|
|
Python 3.13+ gives mode 0o700 an explicit user/admin DACL on Windows. That
|
|
omits the AppContainer SID. Inside our stage, inherit the native private parent
|
|
DACL instead. Kernel permissions and the Job remain the security boundary.
|
|
"""
|
|
import os
|
|
|
|
if os.name == "nt" and os.environ.get("YCODE_SANDBOX") == "appcontainer":
|
|
_mkdir = os.mkdir
|
|
_stage = os.path.normcase(os.path.abspath(os.environ["YCODE_SANDBOX_ROOT"]))
|
|
|
|
def _private_mkdir(path, mode=0o777, *, dir_fd=None):
|
|
if mode == 0o700 and dir_fd is None:
|
|
target = os.path.normcase(os.path.abspath(os.fsdecode(path)))
|
|
try:
|
|
if os.path.commonpath((_stage, target)) == _stage:
|
|
mode = 0o777
|
|
except ValueError:
|
|
pass
|
|
return _mkdir(path, mode, dir_fd=dir_fd)
|
|
|
|
os.mkdir = _private_mkdir
|