Skip to content

test(process-container): realign stale UI policy, captureDenials and clipboard probe tests #1393

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Elliot (theelliotm) merged 9 commits into from
Oct 5, 2026
Merged

test(process-container): realign stale UI policy, captureDenials and clipboard probe tests #1393

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
f587eee
test(process-container): realign UI policy and captureDenials suites
theelliotm Oct 5, 2026
809b819
test(ui-probe): decide the clipboard read verdict on refusal, not rou…
theelliotm Oct 5, 2026
c499de7
test(ui-policy): warn when a read verdict rests on absence of refusal
theelliotm Oct 5, 2026
5aabef9
test(ui-probe): keep the clipboard seed owner alive across the read
theelliotm Oct 5, 2026
29cb9fc
test(process-container): carry probe diagnostics into passing results
theelliotm Oct 5, 2026
ba06215
test(process-container): pass a read verdict that was not refused
theelliotm Oct 5, 2026
60f3b67
test(ui-probe): require CloseClipboard and escape interpolated tags
theelliotm Oct 5, 2026
364d155
test(process-container): require a clipboard round trip where writing…
theelliotm Oct 5, 2026
666697d
test(ui-probe): compare the clipboard read-back against the seeded text
theelliotm Oct 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions docs/process-container/UIPolicy_Schema.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,8 @@ The `"ui"` section is a sibling of `"processContainer"`, `"filesystem"`, `"netwo
| `"write"` | `UILIMIT_READCLIPBOARD` | ❌ Blocked | ✅ Allowed | Process can copy but not paste in |
| `"none"` | `UILIMIT_READCLIPBOARD` + `UILIMIT_WRITECLIPBOARD` | ❌ Blocked | ❌ Blocked | Complete clipboard isolation |

> ✅ means MXC does not set the corresponding UI limit. It does not explicitly enable clipboard access — other parts of the process-container security environment may still deny it.

---

### `isolation`
Expand Down Expand Up @@ -165,6 +167,8 @@ The `"ui"` section is a sibling of `"processContainer"`, `"filesystem"`, `"netwo
| `"display"` | `UILIMIT_SYSTEMPARAMETERS` | ❌ Blocked | ✅ Allowed | Process can change display but not UI params |
| `"none"` | `UILIMIT_SYSTEMPARAMETERS` + `UILIMIT_DISPLAYSETTINGS` | ❌ Blocked | ❌ Blocked | No system settings changes |

> ✅ means MXC does not set the corresponding UI limit. It does not explicitly enable the setting change — other parts of the process-container security environment may still deny it.

---

### `ime`
Expand Down Expand Up @@ -262,7 +266,7 @@ All defaults apply — maximum lockdown.

### Example 3: Selective permissions — GUI with clipboard access

Process has full GUI access and can interact with other windows on the desktop. Full clipboard access is granted, but all other capabilities remain locked down.
Process keeps GUI access and can interact with other windows on the desktop. MXC sets no clipboard limit, but all other capabilities remain locked down.

```json
"ui": {
Expand All @@ -284,7 +288,7 @@ This section is an implementation reference for runner developers. The JSON fiel
| `clipboard` | `"none"` | `JOB_OBJECT_UILIMIT_READCLIPBOARD` + `JOB_OBJECT_UILIMIT_WRITECLIPBOARD` |
| `clipboard` | `"read"` | `JOB_OBJECT_UILIMIT_WRITECLIPBOARD` |
| `clipboard` | `"write"` | `JOB_OBJECT_UILIMIT_READCLIPBOARD` |
| `clipboard` | `"all"` | *(no flags)* |
| `clipboard` | `"all"` | *(no flags; does not explicitly enable clipboard access)* |
| `isolation` | `"container"` | `JOB_OBJECT_UILIMIT_HANDLES` + `JOB_OBJECT_UILIMIT_GLOBALATOMS` |
| `isolation` | `"handles"` | `JOB_OBJECT_UILIMIT_HANDLES` |
| `isolation` | `"atoms"` | `JOB_OBJECT_UILIMIT_GLOBALATOMS` |
Expand All @@ -294,7 +298,7 @@ This section is an implementation reference for runner developers. The JSON fiel
| `systemSettings` | `"none"` | `JOB_OBJECT_UILIMIT_SYSTEMPARAMETERS` + `JOB_OBJECT_UILIMIT_DISPLAYSETTINGS` |
| `systemSettings` | `"parameters"` | `JOB_OBJECT_UILIMIT_DISPLAYSETTINGS` |
| `systemSettings` | `"display"` | `JOB_OBJECT_UILIMIT_SYSTEMPARAMETERS` |
| `systemSettings` | `"all"` | *(no flags)* |
| `systemSettings` | `"all"` | *(no flags; does not explicitly enable the setting changes)* |
| `ime` | `false` | `JOB_OBJECT_UILIMIT_IME` |
| `injection` | `false` | `JOB_OBJECT_UILIMIT_INJECTION` |

Expand Down
4 changes: 4 additions & 0 deletions docs/process-container/os-version-support.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,10 @@ would reject; `wxc-exec --probe` reports what a host can enforce.
| `injection` — INJECTION (`0x200`, ≥ 26100) | ❌ | ✅ | ✅ | ✅ |
| `disable` — `disallowWin32kSystemCalls` mitigation | ✅ | ✅ | ✅ | ✅ |

✅ here means the host can set the flag, not that the permissive value grants
the operation. Omitting a limit never enables anything; see
[UI policy schema](UIPolicy_Schema.md).

The single UI differentiator for 23H2 is **`injection`**
(`JOB_OBJECT_UILIMIT_INJECTION`), which the kernel accepts only on build 26100
and later (`MIN_BUILD_FOR_INJECTION_LIMIT`) and is therefore unavailable on
Expand Down
Loading
Loading