[codex] Scope Windows sandbox write-root capability SIDs

codex-rs/windows-sandbox-rs/src/audit.rs

@@ -2,14 +2,16 @@ use crate::acl::add_deny_write_ace;
 use crate::acl::path_mask_allows;
 use crate::cap::cap_sid_file;
 use crate::cap::load_or_create_cap_sids;
+use crate::cap::workspace_write_cap_sid_for_root;
+use crate::cap::workspace_write_root_contains_path;
 use crate::logging::debug_log;
 use crate::logging::log_note;
 use crate::path_normalization::canonical_path_key;
 use crate::policy::SandboxPolicy;
-use crate::token::convert_string_sid_to_sid;
+use crate::setup::effective_write_roots_for_setup;
+use crate::token::LocalSid;
 use crate::token::world_sid;
 use anyhow::Result;
-use anyhow::anyhow;
 use std::collections::HashSet;
 use std::ffi::OsStr;
 use std::ffi::c_void;
@@ -231,6 +233,7 @@ pub fn apply_world_writable_scan_and_denies(
         &flagged,
         sandbox_policy,
         cwd,
+        env_map,
         logs_base_dir,
     ) {
         log_note(
@@ -246,6 +249,7 @@ pub fn apply_capability_denies_for_world_writable(
     flagged: &[PathBuf],
     sandbox_policy: &SandboxPolicy,
     cwd: &Path,
+    env_map: &std::collections::HashMap<String, String>,
     logs_base_dir: Option<&Path>,
 ) -> Result<()> {
     if flagged.is_empty() {
@@ -255,46 +259,56 @@ pub fn apply_capability_denies_for_world_writable(
     let cap_path = cap_sid_file(codex_home);
     let caps = load_or_create_cap_sids(codex_home)?;
     std::fs::write(&cap_path, serde_json::to_string(&caps)?)?;
-    let (active_sid, workspace_roots): (*mut c_void, Vec<PathBuf>) = match sandbox_policy {
-        SandboxPolicy::WorkspaceWrite { writable_roots, .. } => {
-            let sid = unsafe { convert_string_sid_to_sid(&caps.workspace) }
-                .ok_or_else(|| anyhow!("ConvertStringSidToSidW failed for workspace capability"))?;
-            let mut roots: Vec<PathBuf> =
-                vec![dunce::canonicalize(cwd).unwrap_or_else(|_| cwd.to_path_buf())];
-            for root in writable_roots {
-                let candidate = root.as_path();
-                roots.push(dunce::canonicalize(candidate).unwrap_or_else(|_| root.to_path_buf()));
-            }
-            (sid, roots)
+    let (active_sids, workspace_roots): (Vec<LocalSid>, Vec<PathBuf>) = match sandbox_policy {
+        SandboxPolicy::WorkspaceWrite { .. } => {
+            let roots = effective_write_roots_for_setup(
+                sandbox_policy,
+                cwd,
+                cwd,
+                env_map,
+                codex_home,
+                /*write_roots_override*/ None,
+            );
+            let active_sids = roots
+                .iter()
+                .map(|root| {
+                    workspace_write_cap_sid_for_root(codex_home, cwd, root)
+                        .and_then(|sid| LocalSid::from_string(&sid))
+                })
+                .collect::<Result<Vec<_>>>()?;
+            (active_sids, roots)
+        }
+        SandboxPolicy::ReadOnly { .. } => {
+            (vec![LocalSid::from_string(&caps.readonly)?], Vec::new())
         }
-        SandboxPolicy::ReadOnly { .. } => (
-            unsafe { convert_string_sid_to_sid(&caps.readonly) }
-                .ok_or_else(|| anyhow!("ConvertStringSidToSidW failed for readonly capability"))?,
-            Vec::new(),
-        ),
         SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. } => {
             return Ok(());
         }
     };
     for path in flagged {
-        if workspace_roots.iter().any(|root| path.starts_with(root)) {
+        if workspace_roots
+            .iter()
+            .any(|root| workspace_write_root_contains_path(root, path))
+        {
             continue;
         }
-        let res = unsafe { add_deny_write_ace(path, active_sid) };
-        match res {
-            Ok(true) => log_note(
-                &format!("AUDIT: applied capability deny ACE to {}", path.display()),
-                logs_base_dir,
-            ),
-            Ok(false) => {}
-            Err(err) => log_note(
-                &format!(
-                    "AUDIT: failed to apply capability deny ACE to {}: {}",
-                    path.display(),
-                    err
+        for active_sid in &active_sids {
+            let res = unsafe { add_deny_write_ace(path, active_sid.as_ptr()) };
+            match res {
+                Ok(true) => log_note(
+                    &format!("AUDIT: applied capability deny ACE to {}", path.display()),
+                    logs_base_dir,
                 ),
-                logs_base_dir,
-            ),
+                Ok(false) => {}
+                Err(err) => log_note(
+                    &format!(
+                        "AUDIT: failed to apply capability deny ACE to {}: {}",
+                        path.display(),
+                        err
+                    ),
+                    logs_base_dir,
+                ),
+            }
         }
     }
     Ok(())