fix(windows): verify compiler integrity from raw security entries

Author: e2e

scripts/release/windows-smoke-environment.test.mjs

@@ -1,8 +1,10 @@
 import assert from 'node:assert/strict';
+import { execFile } from 'node:child_process';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import test from 'node:test';
+import { promisify } from 'node:util';
 
 import { verifyWindowsSmokeEnvironment, windowsSmokeEnvironment } from './windows-payload.mjs';
 
@@ -61,6 +63,38 @@ test('Add-Type probe uses constant UTF-16LE encoded source and returns bounded n
   });
 });
 
+test('Windows raw mandatory ACE validator handles labels independently of SDDL formatting', {
+  skip: process.platform !== 'win32', timeout: 45_000,
+}, async () => {
+  const { tsImport } = await import('tsx/esm/api');
+  const { windowsCodeDomLabelValidationScript } = await tsImport(new URL('../../server/gjc-windows-job.ts', import.meta.url).href, import.meta.url);
+  const cases = [
+    { name: 'high', sddl: 'S:(ML;OI;NW;;;HI)', expected: true, count: 1 },
+    { name: 'numeric high SID', sddl: 'S:(ML;OICI;NW;;;S-1-16-12288)', expected: true, count: 1 },
+    { name: 'additional restrictions', sddl: 'S:(ML;OI;NWNR;;;HI)', expected: true, count: 1 },
+    { name: 'medium', sddl: 'S:(ML;OI;NW;;;ME)', expected: false, count: 1 },
+    { name: 'missing no-write-up', sddl: 'S:(ML;OI;NR;;;HI)', expected: false, count: 1 },
+    { name: 'inherit-only', sddl: 'S:(ML;OIIO;NW;;;HI)', expected: false, count: 1 },
+    { name: 'missing SACL', sddl: 'D:(A;;FA;;;BA)', expected: false, count: 0 },
+    { name: 'empty SACL', sddl: 'D:(A;;FA;;;BA)S:AI', expected: false, count: 0 },
+    { name: 'audit ACE is not a label', sddl: 'S:(AU;SA;FA;;;S-1-16-12288)', expected: false, count: 1 },
+  ];
+  const source = `$ErrorActionPreference = 'Stop'
+${windowsCodeDomLabelValidationScript()}
+foreach ($case in ($env:GAJAE_LABEL_FIXTURES | ConvertFrom-Json)) {
+    $state = Get-GajaeCompilerLabelState ([Security.AccessControl.RawSecurityDescriptor]::new($case.sddl))
+    [Console]::Out.WriteLine((@{ name = $case.name; valid = $state.hasHighLabel; count = $state.saclCount; aces = $state.aces } | ConvertTo-Json -Compress -Depth 4))
+}`;
+  const systemRoot = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
+  const { stdout } = await promisify(execFile)(path.join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe'), [
+    '-NoProfile', '-NonInteractive', '-EncodedCommand', Buffer.from(source, 'utf16le').toString('base64'),
+  ], { env: { ...process.env, GAJAE_LABEL_FIXTURES: JSON.stringify(cases) }, windowsHide: true, shell: false, timeout: 30_000 });
+  const results = stdout.trim().split(/\r?\n/).map(line => JSON.parse(line));
+  assert.deepEqual(results.map(({ name, valid, count }) => ({ name, valid, count })),
+    cases.map(({ name, expected, count }) => ({ name, valid: expected, count })));
+  assert.deepEqual(results[0].aces, [{ type: 0x11, size: 20, flags: 1, mask: 1, sid: 'S-1-16-12288' }]);
+});
+
 test('real Windows Add-Type works with baseline and isolated Unicode profile, cwd and temp', {
   skip: process.platform !== 'win32', timeout: 140_000,
 }, async t => {
@@ -92,7 +126,10 @@ test('real Windows Add-Type works with baseline and isolated Unicode profile, cw
       if (result.elevated) {
         assert.match(result.compilerSddl, /\(D;OI;SD;;;/);
         assert.match(result.compilerSddl, /\(A;OICI;FA;;;BA\)/);
-        assert.match(result.compilerSddl, /\(ML;[^;]*;NW;;;HI\)/);
+        assert.equal(result.hasHighLabel, true);
+        assert.ok(result.compilerSaclCount > 0);
+        assert.ok(result.compilerSaclAces.some(ace => ace.type === 0x11
+          && ace.sid === 'S-1-16-12288' && (ace.mask & 1) !== 0 && (ace.flags & 8) === 0));
       }
       await assert.rejects(fs.access(result.compilerTemp), { code: 'ENOENT' });
       if (label === 'isolated Unicode') {

server/gjc-windows-job.test.ts

@@ -11,6 +11,7 @@ import {
   GJC_WINDOWS_JOB_GUARD_READY,
   quoteWindowsArgument,
   windowsCodeDomCompileScript,
+  windowsCodeDomLabelValidationScript,
 } from './gjc-windows-job.js';
 
 test('quotes Windows argv values without losing quotes or trailing slashes', () => {
@@ -43,28 +44,29 @@ test('CodeDom compilation uses explicit private temp files with the original ele
   assert.ok(script.indexOf('$compilerParameters.TempFiles.Delete()') < script.indexOf('[IO.Directory]::Delete'));
 });
 
-test('generated PowerShell label regex matches SDDL and diagnostics precede rejection', () => {
+test('generated PowerShell enforces raw mandatory ACE fields and reports diagnostics before rejection', () => {
   const diagnosticScript = windowsCodeDomCompileScript('public class LabelRegexFixture {}', true);
   const launch = createWindowsJobLaunch('node.exe', [], { SystemRoot: 'C:\\Windows' }, 'C:\\');
   const loader = Buffer.from(launch.args.at(-1)!, 'base64').toString('utf16le');
   const compressed = loader.match(/FromBase64String\('([^']+)'\)/u)?.[1];
   assert.ok(compressed);
   const guardScript = gunzipSync(Buffer.from(compressed, 'base64')).toString('utf8');
   for (const script of [diagnosticScript, guardScript]) {
-    const pattern = script.match(/\$compilerActualSddl -notmatch '([^']+)'/u)?.[1];
-    assert.equal(pattern, String.raw`\(ML;[^;]*;NW;;;HI\)`);
-    const regex = new RegExp(pattern!);
-    for (const high of ['S:(ML;OI;NW;;;HI)', 'D:(A;OICI;FA;;;BA)S:(ML;;NW;;;HI)', 'S:(ML;OICI;NW;;;HI)']) {
-      assert.equal(regex.test(high), true, high);
-    }
-    for (const rejected of ['S:(ML;OI;NW;;;ME)', 'D:(A;OICI;FA;;;BA)', 'S:(ML;OI;NR;;;HI)']) {
-      assert.equal(regex.test(rejected), false, rejected);
-    }
+    assert.ok(script.includes(windowsCodeDomLabelValidationScript()));
+    assert.match(script, /\$ace.AceType -eq 0x11/);
+    assert.match(script, /ToUInt32\(\$bytes, 4\)/);
+    assert.match(script, /SecurityIdentifier\]::new\(\$bytes, 8\)/);
+    assert.match(script, /\$entry.sid -eq 'S-1-16-12288'/);
+    assert.match(script, /\(\$entry.mask -band 1\) -ne 0/);
+    assert.match(script, /\(\$entry.flags -band 8\) -eq 0/);
+    assert.doesNotMatch(script, /\$compilerActualSddl -notmatch/);
+    assert.match(script, /GetFileSecurityW\(\$compilerTemp, 0x14/);
     assert.match(script, /requestedCompilerSddl = \$compilerSddl; compilerSddl = \$compilerActualSddl/);
+    assert.match(script, /compilerSaclCount = \$compilerActualLabels.saclCount; compilerSaclAces = \$compilerActualLabels.aces/);
     assert.match(script, /high-integrity label was not preserved\. ' \+ \$compilerSecurityReport/);
   }
   assert.ok(diagnosticScript.indexOf('[Console]::Out.WriteLine($compilerSecurityReport)')
-    < diagnosticScript.indexOf('$compilerActualSddl -notmatch'));
+    < diagnosticScript.indexOf('$compilerElevated -and -not $compilerActualLabels.hasHighLabel'));
 });
 
 test('builds a guard that atomically creates the worker inside a Windows job', () => {

server/gjc-windows-job.ts

@@ -13,9 +13,43 @@ const REAP_ENV = 'GAJAE_INTERNAL_JOB_REAP';
 export const GJC_WINDOWS_JOB_GUARD_READY = 'gajae-job-guard-ready-v1';
 export const GJC_WINDOWS_JOB_GUARD_ACK = 'gajae-job-guard-ack-v1';
 
+/** Inspect raw mandatory ACEs: GetSddlForm(All) does not request label output. */
+export function windowsCodeDomLabelValidationScript(): string {
+  return String.raw`
+function Get-GajaeCompilerLabelState([Security.AccessControl.RawSecurityDescriptor]$security) {
+    $entries = @()
+    $count = 0
+    $hasHighLabel = $false
+    $malformedLabel = $false
+    if ($null -ne $security.SystemAcl) { $count = $security.SystemAcl.Count }
+    foreach ($ace in $security.SystemAcl) {
+        $entry = @{ type = [int]$ace.AceType; size = $ace.BinaryLength; flags = [int]$ace.AceFlags }
+        if ([int]$ace.AceType -eq 0x11) {
+            try {
+                # SYSTEM_MANDATORY_LABEL_ACE: header at 0, mask at 4, SID at 8.
+                if ($ace.BinaryLength -lt 16) { throw 'Truncated mandatory-label ACE.' }
+                $bytes = [byte[]]::new($ace.BinaryLength)
+                $ace.GetBinaryForm($bytes, 0)
+                $entry.mask = [BitConverter]::ToUInt32($bytes, 4)
+                $entry.sid = [Security.Principal.SecurityIdentifier]::new($bytes, 8).Value
+                # Inherit-only ACEs do not protect this directory itself.
+                if ($entry.sid -eq 'S-1-16-12288' -and ($entry.mask -band 1) -ne 0 -and ($entry.flags -band 8) -eq 0) { $hasHighLabel = $true }
+            } catch {
+                $malformedLabel = $true
+                $entry.error = $_.Exception.Message
+            }
+        }
+        $entries += $entry
+    }
+    return @{ hasHighLabel = ($hasHighLabel -and -not $malformedLabel); saclCount = $count; aces = $entries }
+}
+`.trim();
+}
+
 /** Compiles trusted constant C# without CodeDom's ANSI elevated-temp helper. */
 export function windowsCodeDomCompileScript(typeDefinition: string, diagnostics = false): string {
   return String.raw`
+${windowsCodeDomLabelValidationScript()}
 $compilerIdentity = [Security.Principal.WindowsIdentity]::GetCurrent()
 $compilerSid = $compilerIdentity.User.Value
 $compilerPrincipal = [Security.Principal.WindowsPrincipal]::new($compilerIdentity)
@@ -87,10 +121,13 @@ try {
     }
     $compilerActualSecurity = [Security.AccessControl.RawSecurityDescriptor]::new($compilerActualBytes, 0)
     $compilerActualSddl = $compilerActualSecurity.GetSddlForm([Security.AccessControl.AccessControlSections]::All)
-    $compilerSecurityReport = (@{ compilerTemp = $compilerTemp; elevated = $compilerElevated; requestedCompilerSddl = $compilerSddl; compilerSddl = $compilerActualSddl } | ConvertTo-Json -Compress)
+    $compilerRequestedLabels = Get-GajaeCompilerLabelState $compilerSecurity
+    $compilerActualLabels = Get-GajaeCompilerLabelState $compilerActualSecurity
+    $compilerSecurityReport = (@{ compilerTemp = $compilerTemp; elevated = $compilerElevated; requestedCompilerSddl = $compilerSddl; compilerSddl = $compilerActualSddl; requestedSaclCount = $compilerRequestedLabels.saclCount; requestedSaclAces = $compilerRequestedLabels.aces; compilerSaclCount = $compilerActualLabels.saclCount; compilerSaclAces = $compilerActualLabels.aces; hasHighLabel = $compilerActualLabels.hasHighLabel } | ConvertTo-Json -Compress -Depth 4)
     ${diagnostics ? '[Console]::Out.WriteLine($compilerSecurityReport)' : ''}
-    # String.raw preserves the single backslash required by PowerShell/.NET.
-    if ($compilerElevated -and $compilerActualSddl -notmatch '\(ML;[^;]*;NW;;;HI\)') {
+    # GetSddlForm(All) serializes auditing SACL flags, not LABEL_SECURITY_INFORMATION.
+    # Enforce the label from the returned raw ACE fields instead of its SDDL text.
+    if ($compilerElevated -and -not $compilerActualLabels.hasHighLabel) {
         throw ('Compiler directory high-integrity label was not preserved. ' + $compilerSecurityReport)
     }
     $compilerParameters = [CodeDom.Compiler.CompilerParameters]::new()