[GH-ISSUE #327] Create and read back protected runtime-root DACLs via native Node-API #173

New issue

Open

opened 2026-10-15 18:22:02 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:22:02 +00:00

Owner

Originally created by @morluto on GitHub (Jul 20, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/327

Create a directory with a protected DACL that grants only the current user and SYSTEM the required access, and read the security descriptor back by handle to verify owner, DACL presence, protected/inheritance state, admitted trustees, and absence of broad/null entries.

Acceptance:

Native implementation creates the root and child objects with the intended policy.
Readback verifies owner, explicit/inherited ACEs, propagation, and trustee vocabulary.
Null DACLs, broad allow entries, additional trustees, and unsupported filesystems fail closed.

Part of #290.

Originally created by @morluto on GitHub (Jul 20, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/327 Create a directory with a protected DACL that grants only the current user and SYSTEM the required access, and read the security descriptor back by handle to verify owner, DACL presence, protected/inheritance state, admitted trustees, and absence of broad/null entries. Acceptance: - Native implementation creates the root and child objects with the intended policy. - Readback verifies owner, explicit/inherited ACEs, propagation, and trustee vocabulary. - Null DACLs, broad allow entries, additional trustees, and unsupported filesystems fail closed. Part of #290.

bsakaguchi added the

area: native

P1: high

enhancement

labels

2026-10-15 18:22:02 +00:00

bsakaguchi referenced this issue

2026-10-16 21:11:53 +00:00

[PR #210] [MERGED] fix: preserve setup diagnostics and clean Knip config #1860

bsakaguchi added

enhancement

and removed