fix(agent): support app execution aliases for elevated broker executions - #1907
Conversation
The per-user winget.exe under %LOCALAPPDATA%\Microsoft\WindowsApps is an APPEXECLINK reparse point that cannot be opened for read, so the broker's elevated-executable verification failed with 'failed to open elevated package-manager executable'. Verification now resolves the alias to its real target and verifies/pins that instead. The resolved Store binaries under Program Files\WindowsApps also exposed two DACL patterns the fail-closed ACE walk rejected: conditional (callback) allow ACEs and process trust-label SIDs (S-1-19-*). Callback allow ACEs share the allow-ACE layout and their condition can only narrow the grant, so they are treated as unconditional allows; trust-label SIDs are only ever held by Windows-signed protected processes, so they are trusted for the executable check (not the policy file). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Let maintainers know that an action is required on their side
|
There was a problem hiding this comment.
Pull request overview
Adds secure resolution of Microsoft Store app execution aliases for elevated broker operations.
Changes:
- Resolves AppExecLink aliases to their Store executable targets.
- Supports callback ACEs and process trust-label SIDs.
- Adds alias parsing and security verification tests.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
devolutions-agent/src/broker/policy_security.rs |
Implements alias resolution and expands executable ACL verification. |
devolutions-agent/Cargo.toml |
Enables required Windows IO APIs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…ackage identity The alias reparse data lives in user-writable %LOCALAPPDATA%, so its target is untrusted: validate the package family, executable name, and package directory before substituting the target for elevated verification. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
d45b176
into
master
Fixes elevated package broker executions failing with 'failed to open elevated package-manager executable' when the package manager resolves to a Microsoft Store app execution alias, such as the per-user
winget.exeunder%LOCALAPPDATA%\Microsoft\WindowsApps.Alias reparse points cannot be opened for read, so the anti-tampering verification could never pin them. Verification now resolves the alias to the real Store binary and verifies and executes that instead, keeping the full owner/DACL/ancestor-directory checks on the actual image that is loaded.
Resolving the alias also surfaced two DACL patterns on Store binaries that the fail-closed ACE walk rejected; both are now handled:
S-1-19-*), which the kernel only assigns to Windows-signed protected processes, are trusted for the executable check only (not for the policy file).