Conversation
Co-authored-by: codex <codex@openai.com>
Co-authored-by: codex <codex@openai.com>
m62624
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Confirmed native regression
The new
concurrent_read_grant_does_not_widen_an_existing_sandboxtest demonstrates a Windows isolation failure: a long-running guardian cannot read a file before a second sandbox receives a read grant, but can read it while that other sandbox runs. The second Windows CI run confirms this on the real backend.Current status
Draft investigation, not a verified fix and not ready for release. The initial attempt to replace the installation-wide read SID with a per-profile SID does not prevent the leak; the native test remains red.
CreateRestrictedTokencurrently usesWRITE_RESTRICTED, under which restricting SIDs do not constrain reads. The runner account/group ACL grant is shared by concurrent launches. A correct fix must change that normal-token read authority or the process/account boundary, without breaking Windows session startup and existing native tests.BOSS currently rejects dynamic additional-permission launches on Windows before native preparation. Initial sessions and Linux/macOS escalation remain available. Do not publish a Cageforge release from this draft until the native test passes.