@dsh-electron/dsh-plugin-multi-root-workspace 0.1.6 → 0.1.7

package/scripts/windows-broker/service.cs

@@ -0,0 +1,323 @@
+// A narrow privileged service: mirror the authenticated process identity and add
+// only deny-only normal groups. It never opens files or launches commands.
+using System;
+using System.ComponentModel;
+using System.IO;
+using System.IO.Pipes;
+using System.Runtime.InteropServices;
+using System.Security.AccessControl;
+using System.Security.Principal;
+using System.ServiceProcess;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading;
+using System.Threading.Tasks;
+
+public sealed class RootDenyBroker : ServiceBase {
+    // Same bounded IPC contract as MAX_WINDOWS_DENY_ROOTS in the client.
+    const int MaxDenyRoots = 256;
+    const int MaxRequestBytes = 32768;
+    readonly string sid, pipeName;
+    volatile bool stopping;
+    NamedPipeServerStream listener;
+    readonly SemaphoreSlim slots = new SemaphoreSlim(8);
+    RootDenyBroker(string sid, string name) {
+        this.sid = new SecurityIdentifier(sid).Value;
+        pipeName = name;
+        ServiceName = name;
+        CanStop = true;
+    }
+    public static void Main(string[] args) {
+        if (args.Length != 2 || !Regex.IsMatch(args[1], @"^DshMultiRootBroker-[a-f0-9]{16}$"))
+            throw new ArgumentException("Expected installation SID and pipe name");
+        ServiceBase.Run(new RootDenyBroker(args[0], args[1]));
+    }
+    protected override void OnStart(string[] args) {
+        EnablePrivilege("SeTcbPrivilege");
+        EnablePrivilege("SeDebugPrivilege");
+        EnablePrivilege("SeImpersonatePrivilege");
+        Task.Run((Action)Serve);
+    }
+    protected override void OnStop() {
+        stopping = true;
+        if (listener != null) listener.Dispose();
+    }
+    void Serve() {
+        var security = new PipeSecurity();
+        security.SetAccessRuleProtection(true, false);
+        security.AddAccessRule(new PipeAccessRule(WindowsIdentity.GetCurrent().User, PipeAccessRights.FullControl, AccessControlType.Allow));
+        security.AddAccessRule(new PipeAccessRule(new SecurityIdentifier("S-1-5-18"), PipeAccessRights.FullControl, AccessControlType.Allow));
+        // The runner reads the kernel attribute back; a spoofed ACK cannot authorize a launch.
+        security.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(sid), PipeAccessRights.ReadWrite | PipeAccessRights.Synchronize, AccessControlType.Allow));
+        security.AddAccessRule(new PipeAccessRule(new SecurityIdentifier("S-1-5-2"), PipeAccessRights.FullControl, AccessControlType.Deny));
+        while (!stopping) {
+            NamedPipeServerStream pipe = null;
+            try {
+                slots.Wait();
+                pipe = new NamedPipeServerStream(pipeName, PipeDirection.InOut, 8, PipeTransmissionMode.Byte,
+                    PipeOptions.Asynchronous, 4096, 4096, security);
+                listener = pipe;
+                pipe.WaitForConnection();
+                var connected = pipe;
+                pipe = null;
+                Task.Run(() => { try { Handle(connected); } finally { connected.Dispose(); slots.Release(); } });
+            } catch { if (pipe != null) pipe.Dispose(); slots.Release(); if (stopping) return; Thread.Sleep(100); }
+        }
+    }
+    void Handle(NamedPipeServerStream pipe) {
+        try {
+            // A pipe impersonation context exists only after its first read.
+            // Reading a bounded request performs no privileged operation.
+            var read = Task.Run(() => ReadRequest(pipe));
+            if (!read.Wait(5000)) throw new System.TimeoutException("Request timeout");
+            // Authenticate the pipe token, not a SID or PID supplied in data.
+            string caller = null;
+            pipe.RunAsClient(() => { caller = WindowsIdentity.GetCurrent().User.Value; });
+            if (caller != sid) throw new UnauthorizedAccessException("Caller SID mismatch");
+            uint pid;
+            Check(GetNamedPipeClientProcessId(pipe.SafePipeHandle.DangerousGetHandle(), out pid), "GetNamedPipeClientProcessId");
+            string[] fields = read.Result.Split('|');
+            bool assigning = fields.Length == 4 && fields[0] == "3";
+            if ((!assigning && (fields.Length != 3 || fields[0] != "2")) || !Regex.IsMatch(fields[1], @"^[0-9]{1,20}$")
+                || (assigning && !Regex.IsMatch(fields[2], @"^[0-9]{1,20}$")))
+                throw new ArgumentException("Invalid request");
+            string[] roots = fields[fields.Length - 1].Split(',');
+            if (roots.Length < 1 || roots.Length > MaxDenyRoots) throw new ArgumentException("Invalid root count");
+            foreach (var root in roots)
+                if (!Regex.IsMatch(root, @"^S-1-4-[0-9]{1,10}-[0-9]{1,10}-[0-9]{1,10}-[0-9]{1,10}-3$"))
+                    throw new ArgumentException("Invalid deny identity");
+            IntPtr process = OpenProcess(0x1040, false, pid);
+            if (process == IntPtr.Zero) throw new Win32Exception();
+            IntPtr token = IntPtr.Zero, processToken = IntPtr.Zero, minted = IntPtr.Zero;
+            try {
+                // SeDebugPrivilege opens the process, not its token object. Acquire
+                // only QUERY/QUERY_SOURCE while impersonating the authenticated
+                // pipe caller, then revert before any privileged minting.
+                pipe.RunAsClient(() => { Check(OpenProcessToken(process, 0x18, out processToken), "OpenProcessToken(client)"); });
+                if (TokenSid(processToken) != sid)
+                    throw new UnauthorizedAccessException("Caller process must be an unrestricted installation identity");
+                RefuseRestrictedSource(processToken);
+                if (assigning) {
+                    AssignToChild(process, processToken, pid, fields[1], fields[2], roots, pipe);
+                    return;
+                }
+                Check(DuplicateHandle(process, new IntPtr(unchecked((long)UInt64.Parse(fields[1]))), GetCurrentProcess(), out token,
+                    8, false, 0), "DuplicateHandle(token)");
+                bool equal;
+                NtCheck(NtCompareTokens(processToken, token, out equal), "NtCompareTokens");
+                if (!equal) throw new UnauthorizedAccessException("Source is not the caller process token");
+                minted = MintDenyToken(processToken, roots);
+                IntPtr remote;
+                // Only rights needed to derive and protect the launch token; no
+                // group/privilege adjustment or owner changes.
+                Check(DuplicateHandle(GetCurrentProcess(), minted, process, out remote,
+                    0x6008B, false, 0), "DuplicateHandle(reply)"); // WRITE_DAC | READ_CONTROL | QUERY | DUPLICATE | ASSIGN_PRIMARY | ADJUST_DEFAULT
+                try { Reply(pipe, "OK|" + unchecked((ulong)remote.ToInt64()) + "\n"); }
+                catch {
+                    IntPtr cleanup;
+                    if (DuplicateHandle(process, remote, GetCurrentProcess(), out cleanup, 0, false, 1)) CloseHandle(cleanup);
+                    throw;
+                }
+            } finally {
+                if (minted != IntPtr.Zero) CloseHandle(minted);
+                if (token != IntPtr.Zero) CloseHandle(token);
+                if (processToken != IntPtr.Zero) CloseHandle(processToken);
+                CloseHandle(process);
+            }
+        } catch (Exception e) { try { Reply(pipe, "ERROR:" + e.GetType().Name + ":" + e.Message.Replace('\n', ' ').Replace('\r', ' ') + "\n"); } catch {} }
+    }
+    void AssignToChild(IntPtr caller, IntPtr source, uint pid, string processField, string threadField, string[] roots, NamedPipeServerStream pipe) {
+        IntPtr child = IntPtr.Zero, thread = IntPtr.Zero, original = IntPtr.Zero, token = IntPtr.Zero;
+        try {
+            Check(DuplicateHandle(caller, new IntPtr(unchecked((long)UInt64.Parse(processField))), GetCurrentProcess(), out child,
+                0x600, false, 0), "DuplicateHandle(child)"); // SET_INFORMATION | QUERY_INFORMATION
+            Check(DuplicateHandle(caller, new IntPtr(unchecked((long)UInt64.Parse(threadField))), GetCurrentProcess(), out thread,
+                0x2C0, false, 0), "DuplicateHandle(primary thread)"); // QUERY | SET_TOKEN | DIRECT_IMPERSONATION
+            ProcessBasicInformation info; int length;
+            NtCheck(NtQueryInformationProcess(child, 0, out info, Marshal.SizeOf(typeof(ProcessBasicInformation)), out length), "NtQueryInformationProcess(child)");
+            if (info.ParentId.ToUInt64() != pid || info.ProcessId.ToUInt64() == pid
+                || GetProcessIdOfThread(thread) != info.ProcessId.ToUInt64())
+                throw new UnauthorizedAccessException("Not a direct caller-owned child thread");
+            pipe.RunAsClient(() => { Check(OpenProcessToken(child, 8, out original), "OpenProcessToken(child)"); });
+            bool equal; NtCheck(NtCompareTokens(source, original, out equal), "NtCompareTokens(child)");
+            if (!equal) throw new UnauthorizedAccessException("Child identity does not match its caller");
+            token = MintDenyToken(source, roots);
+            ProtectToken(token, TokenSid(source));
+            EnablePrivilege("SeAssignPrimaryTokenPrivilege");
+            var access = new ProcessAccessToken { Token = token, Thread = thread };
+            // The kernel refuses assignment after the initial thread starts.
+            // No argv, executable, environment or path enters this operation.
+            NtCheck(NtSetInformationProcess(child, 9, ref access, Marshal.SizeOf(typeof(ProcessAccessToken))), "NtSetInformationProcess(access token)");
+            Reply(pipe, "OK\n");
+        } finally {
+            foreach (var h in new[] { token, original, thread, child }) if (h != IntPtr.Zero) CloseHandle(h);
+        }
+    }
+    static void ProtectToken(IntPtr token, string user) {
+        var descriptor = new RawSecurityDescriptor("D:(D;;0xc00e0;;;" + user + ")(A;;GA;;;" + user + ")(A;;RC;;;OW)");
+        var bytes = new byte[descriptor.DiscretionaryAcl.BinaryLength]; descriptor.DiscretionaryAcl.GetBinaryForm(bytes, 0);
+        IntPtr acl = Marshal.AllocHGlobal(bytes.Length);
+        try {
+            Marshal.Copy(bytes, 0, acl, bytes.Length);
+            uint code = SetSecurityInfo(token, 6, 4, IntPtr.Zero, IntPtr.Zero, acl, IntPtr.Zero);
+            if (code != 0) throw new Win32Exception((int)code, "SetSecurityInfo(token)");
+        } finally { Marshal.FreeHGlobal(acl); }
+    }
+    static string ReadRequest(Stream stream) {
+        var data = new MemoryStream();
+        for (int n = 0; n < MaxRequestBytes; n++) {
+            int value = stream.ReadByte();
+            if (value < 0) throw new IOException("Disconnected");
+            if (value == 10) return Encoding.ASCII.GetString(data.ToArray());
+            if (value < 32 || value > 126) throw new ArgumentException("Invalid byte");
+            data.WriteByte((byte)value);
+        }
+        throw new ArgumentException("Request too large");
+    }
+    static void Reply(Stream stream, string value) { var bytes = Encoding.UTF8.GetBytes(value); stream.Write(bytes, 0, bytes.Length); stream.Flush(); }
+    static string TokenSid(IntPtr token) {
+        int length;
+        GetTokenInformation(token, 1, IntPtr.Zero, 0, out length);
+        if (length < IntPtr.Size || length > 65536) throw new ArgumentException("Invalid token");
+        IntPtr data = Marshal.AllocHGlobal(length);
+        try { Check(GetTokenInformation(token, 1, data, length, out length), "GetTokenInformation(user)"); return new SecurityIdentifier(Marshal.ReadIntPtr(data)).Value; }
+        finally { Marshal.FreeHGlobal(data); }
+    }
+    // UAC-filtered callers (TokenHasRestrictions) are accepted: minting only
+    // mirrors the caller's own groups, privileges and label, so no authority is
+    // gained. Real restricting SID lists and AppContainer stay refused.
+    static void RefuseRestrictedSource(IntPtr token) {
+        if (IsTokenRestricted(token))
+            throw new UnauthorizedAccessException("Caller process token carries restricting SIDs");
+        var data = Query(token, 29);
+        try {
+            if (Marshal.ReadInt32(data) != 0)
+                throw new UnauthorizedAccessException("AppContainer caller unsupported");
+        } finally { Marshal.FreeHGlobal(data); }
+    }
+    static IntPtr Query(IntPtr token, int kind) {
+        int length;
+        GetTokenInformation(token, kind, IntPtr.Zero, 0, out length);
+        if (length < 0 || length > 1048576) throw new ArgumentException("Invalid token information size kind=" + kind + " length=" + length);
+        // Empty claim/group channels can report zero bytes on the sizing call.
+        // A real second query must still succeed; never infer absence from an error.
+        int capacity = Math.Max(length, 16);
+        var data = Marshal.AllocHGlobal(capacity);
+        Marshal.Copy(new byte[capacity], 0, data, capacity);
+        try { Check(GetTokenInformation(token, kind, data, capacity, out length), "GetTokenInformation(" + kind + ")"); return data; }
+        catch { Marshal.FreeHGlobal(data); throw; }
+    }
+    static void RejectInheritedAttributes(IntPtr source) {
+        int length;
+        NtQuerySecurityAttributesToken(source, IntPtr.Zero, 0, IntPtr.Zero, 0, out length);
+        if (length < 16 || length > 1048576) throw new ArgumentException("Invalid local attributes size");
+        var data = Marshal.AllocHGlobal(length);
+        try {
+            NtCheck(NtQuerySecurityAttributesToken(source, IntPtr.Zero, 0, data, length, out length), "NtQuerySecurityAttributesToken(source)");
+            uint count = unchecked((uint)Marshal.ReadInt32(data, 4));
+            if (Marshal.ReadInt16(data) != 1 || count > 128) throw new ArgumentException("Invalid local attributes");
+            var array = Marshal.ReadIntPtr(data, 8);
+            for (int i = 0; i < count; i++) {
+                // Native TOKEN_SECURITY_ATTRIBUTE_V1: UNICODE_STRING Name,
+                // type/reserved, flags, count, values (40 bytes on 64-bit).
+                if ((Marshal.ReadInt32(array, i * 40 + 20) & 1) == 0)
+                    throw new UnauthorizedAccessException("Inheritable local security attributes unsupported");
+            }
+        } finally { Marshal.FreeHGlobal(data); }
+    }
+    static IntPtr MintDenyToken(IntPtr source, string[] roots) {
+        EnablePrivilege("SeCreateTokenPrivilege");
+        var memory = new System.Collections.Generic.List<IntPtr>();
+        IntPtr token = IntPtr.Zero;
+        try {
+            Func<int, IntPtr> query = kind => { var p = Query(source, kind); memory.Add(p); return p; };
+            // Fail closed for token types whose full authority cannot be mirrored here.
+            if (Marshal.ReadInt32(query(29)) != 0)
+                throw new UnauthorizedAccessException("AppContainer source unsupported");
+            // NtCreateTokenEx cannot silently discard enterprise/device claims.
+            // This narrow broker accepts only sources without those channels.
+            if (Marshal.ReadInt32(query(33), 4) != 0 || Marshal.ReadInt32(query(34), 4) != 0
+                || Marshal.ReadInt32(query(37)) != 0)
+                throw new UnauthorizedAccessException("Claim-bearing source unsupported");
+            RejectInheritedAttributes(source);
+            var user = query(1); var originalGroups = query(2); var privileges = query(3);
+            var owner = query(4); var primary = query(5); var dacl = query(6); var tokenSource = query(7);
+            var statistics = (TokenStatistics)Marshal.PtrToStructure(query(10), typeof(TokenStatistics));
+            var session = query(12); var mandatory = query(27);
+            int count = Marshal.ReadInt32(originalGroups), stride = Marshal.SizeOf(typeof(SidAttributes));
+            if (count < 0 || count > 4096) throw new ArgumentException("Invalid group count");
+            int offset = IntPtr.Size == 8 ? 8 : 4;
+            var groups = Marshal.AllocHGlobal(offset + (count + roots.Length) * stride); memory.Add(groups);
+            Marshal.WriteInt32(groups, count + roots.Length);
+            for (int i = 0; i < count; i++) {
+                var group = (SidAttributes)Marshal.PtrToStructure(IntPtr.Add(originalGroups, offset + i * stride), typeof(SidAttributes));
+                Marshal.StructureToPtr(group, IntPtr.Add(groups, offset + i * stride), false);
+            }
+            for (int i = 0; i < roots.Length; i++) {
+                var identity = new SecurityIdentifier(roots[i]); var bytes = new byte[identity.BinaryLength]; identity.GetBinaryForm(bytes, 0);
+                var p = Marshal.AllocHGlobal(bytes.Length); memory.Add(p); Marshal.Copy(bytes, 0, p, bytes.Length);
+                // Private intermediate token only. Convert these normal groups
+                // to deny-only before any handle can leave the broker.
+                Marshal.StructureToPtr(new SidAttributes { Sid = p, Attributes = 7 }, IntPtr.Add(groups, offset + (count + i) * stride), false);
+            }
+            var qos = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(SecurityQualityOfService))); memory.Add(qos);
+            Marshal.StructureToPtr(new SecurityQualityOfService { Length = Marshal.SizeOf(typeof(SecurityQualityOfService)), ImpersonationLevel = 2, ContextTrackingMode = 1 }, qos, false);
+            var attributes = new ObjectAttributes { Length = Marshal.SizeOf(typeof(ObjectAttributes)), SecurityQualityOfService = qos };
+            NtCheck(NtCreateTokenEx(out token, 0xF01FF, ref attributes, 1,
+                ref statistics.AuthenticationId, ref statistics.ExpirationTime, user, groups, privileges,
+                IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, mandatory, owner, primary, dacl, tokenSource), "NtCreateTokenEx");
+            IntPtr narrowed;
+            Check(CreateRestrictedToken(token, 1, (uint)roots.Length, IntPtr.Add(groups, offset + count * stride),
+                0, IntPtr.Zero, 0, IntPtr.Zero, out narrowed), "CreateRestrictedToken(broker deny groups)");
+            CloseHandle(token); token = narrowed;
+            Check(SetTokenInformation(token, 12, session, 4), "SetTokenInformation(session)");
+            var result = token; token = IntPtr.Zero; return result;
+        } finally {
+            if (token != IntPtr.Zero) CloseHandle(token);
+            foreach (var p in memory) Marshal.FreeHGlobal(p);
+        }
+    }
+    static void NtCheck(int code, string name) {
+        if (code < 0) { int error = unchecked((int)RtlNtStatusToDosError(code)); throw new Win32Exception(error, name + " NTSTATUS=" + unchecked((uint)code).ToString("x") + " win32=" + error); }
+    }
+    static void Check(bool ok, string name) { if (!ok) { int error = Marshal.GetLastWin32Error(); throw new Win32Exception(error, name + " win32=" + error); } }
+    static void EnablePrivilege(string name) {
+        IntPtr token; Check(OpenProcessToken(GetCurrentProcess(), 0x28, out token), "OpenProcessToken(service)");
+        try { Luid luid; Check(LookupPrivilegeValue(null, name, out luid), "LookupPrivilegeValue");
+            var privileges = new TokenPrivileges { Count = 1, Luid = luid, Attributes = 2 };
+            Check(AdjustTokenPrivileges(token, false, ref privileges, 0, IntPtr.Zero, IntPtr.Zero), "AdjustTokenPrivileges");
+            int error = Marshal.GetLastWin32Error(); if (error != 0) throw new Win32Exception(error, "EnablePrivilege(" + name + ") win32=" + error);
+        } finally { CloseHandle(token); }
+    }
+    [StructLayout(LayoutKind.Sequential)] struct ProcessAccessToken { public IntPtr Token, Thread; }
+    [StructLayout(LayoutKind.Sequential)] struct ProcessBasicInformation { public int ExitStatus; public IntPtr Peb; public UIntPtr Affinity; public int Priority; public UIntPtr ProcessId, ParentId; }
+    [DllImport("ntdll.dll")] static extern int NtQueryInformationProcess(IntPtr process, int kind, out ProcessBasicInformation info, int size, out int length);
+    [DllImport("ntdll.dll")] static extern int NtSetInformationProcess(IntPtr process, int kind, ref ProcessAccessToken info, int size);
+    [DllImport("kernel32.dll", SetLastError=true)] static extern uint GetProcessIdOfThread(IntPtr thread);
+    [DllImport("advapi32.dll")] static extern uint SetSecurityInfo(IntPtr handle, int kind, uint info, IntPtr owner, IntPtr group, IntPtr dacl, IntPtr sacl);
+    [StructLayout(LayoutKind.Sequential)] struct SidAttributes { public IntPtr Sid; public uint Attributes; }
+    [StructLayout(LayoutKind.Sequential)] struct ObjectAttributes { public int Length; public IntPtr RootDirectory, ObjectName; public uint Attributes; public IntPtr SecurityDescriptor, SecurityQualityOfService; }
+    [StructLayout(LayoutKind.Sequential)] struct SecurityQualityOfService { public int Length, ImpersonationLevel; public byte ContextTrackingMode, EffectiveOnly; }
+    [StructLayout(LayoutKind.Sequential)] struct TokenStatistics { public Luid TokenId, AuthenticationId; public long ExpirationTime; public int Type, ImpersonationLevel; public uint DynamicCharged, DynamicAvailable, GroupCount, PrivilegeCount; public Luid ModifiedId; }
+    [DllImport("ntdll.dll")] static extern int NtCreateTokenEx(out IntPtr token, uint access, ref ObjectAttributes attributes, int type,
+        ref Luid authId, ref long expiration, IntPtr user, IntPtr groups, IntPtr privileges, IntPtr userClaims, IntPtr deviceClaims,
+        IntPtr deviceGroups, IntPtr mandatory, IntPtr owner, IntPtr primary, IntPtr dacl, IntPtr source);
+    [DllImport("ntdll.dll")] static extern int NtCompareTokens(IntPtr first, IntPtr second, [MarshalAs(UnmanagedType.U1)] out bool equal);
+    [DllImport("ntdll.dll")] static extern uint RtlNtStatusToDosError(int status);
+    [DllImport("ntdll.dll")] static extern int NtQuerySecurityAttributesToken(IntPtr token, IntPtr names, uint count, IntPtr data, int size, out int length);
+    [StructLayout(LayoutKind.Sequential)] struct Luid { public uint Low; public int High; }
+    [StructLayout(LayoutKind.Sequential)] struct TokenPrivileges { public uint Count; public Luid Luid; public uint Attributes; }
+    [DllImport("kernel32.dll", SetLastError=true)] static extern bool GetNamedPipeClientProcessId(IntPtr pipe, out uint pid);
+    [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access, bool inherit, uint pid);
+    [DllImport("kernel32.dll")] static extern IntPtr GetCurrentProcess();
+    [DllImport("kernel32.dll", SetLastError=true)] static extern bool DuplicateHandle(IntPtr source, IntPtr handle, IntPtr target, out IntPtr duplicate, uint access, bool inherit, uint options);
+    [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+    [DllImport("advapi32.dll", SetLastError=true)] static extern bool OpenProcessToken(IntPtr process, uint access, out IntPtr token);
+    [DllImport("advapi32.dll", SetLastError=true)] static extern bool GetTokenInformation(IntPtr token, int kind, IntPtr data, int size, out int length);
+    [DllImport("advapi32.dll", SetLastError=true)] static extern bool SetTokenInformation(IntPtr token, int kind, IntPtr data, int size);
+    [DllImport("advapi32.dll", SetLastError=true)] static extern bool CreateRestrictedToken(IntPtr token, uint flags, uint disableCount, IntPtr disableSids,
+        uint deleteCount, IntPtr deletePrivileges, uint restrictCount, IntPtr restrictSids, out IntPtr result);
+    [DllImport("advapi32.dll")] static extern bool IsTokenRestricted(IntPtr token);
+    [DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool LookupPrivilegeValue(string system, string name, out Luid luid);
+    [DllImport("advapi32.dll", SetLastError=true)] static extern bool AdjustTokenPrivileges(IntPtr token, bool disable, ref TokenPrivileges privileges, int size, IntPtr previous, IntPtr returned);
+}

package/scripts/windows-broker/verify-install.ps1

@@ -0,0 +1,80 @@
+# Native lifecycle evidence on an elevated, disposable Windows CI host.
+$ErrorActionPreference = 'Stop'
+$installer = Join-Path $PSScriptRoot 'install.ps1'
+$sid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+$sha = [Security.Cryptography.SHA256]::Create()
+try { $hash = ([BitConverter]::ToString($sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($sid)))).Replace('-', '').ToLower().Substring(0,16) }
+finally { $sha.Dispose() }
+$name = "DshMultiRootBroker-$hash"
+$serviceSid = [regex]::Match((sc.exe showsid $name | Out-String), 'S-1-5-80-(?:[0-9]+-){4}[0-9]+').Value
+$record = Join-Path (Join-Path $env:ProgramFiles $name) 'added-rights.json'
+$required = @('SeServiceLogonRight','SeCreateTokenPrivilege','SeAssignPrimaryTokenPrivilege','SeTcbPrivilege','SeDebugPrivilege','SeImpersonatePrivilege')
+function Read-Policy {
+    $file = Join-Path $env:TEMP ([Guid]::NewGuid().ToString() + '.inf')
+    try {
+        secedit.exe /export /cfg $file /areas USER_RIGHTS /quiet | Out-Null
+        if ($LASTEXITCODE -ne 0) { throw 'Cannot export account policy.' }
+        $policy = @{}
+        foreach ($line in Get-Content $file) {
+            if ($line -match '^(Se\w+)\s*=\s*(.*)$') { $policy[$Matches[1]] = @($Matches[2].Split(',') | ForEach-Object { $_.Trim().TrimStart('*') } | Where-Object { $_ } | Sort-Object) }
+        }
+        return $policy
+    } finally { Remove-Item $file -Force -ErrorAction SilentlyContinue }
+}
+function Assert-Rights($policy, $expected) {
+    foreach ($right in $required) {
+        if (($policy[$right] -contains $serviceSid) -ne ($expected -contains $right)) { throw "Unexpected service policy for $right" }
+    }
+}
+# Capture the host's installed state; the installer must not touch other SIDs.
+$installed = Read-Policy
+Assert-Rights $installed $required
+$added = [string[]]@(Get-Content -Raw $record | ConvertFrom-Json)
+$preexisting = @($required | Where-Object { $added -notcontains $_ })
+& $installer -Uninstall
+$baseline = Read-Policy
+Assert-Rights $baseline $preexisting
+if (Get-Service $name -ErrorAction SilentlyContinue) { throw 'Service remains after uninstall.' }
+if (Test-Path (Split-Path $record)) { throw 'Installation directory remains after uninstall.' }
+foreach ($right in $required) {
+    if ((@($installed[$right] | Where-Object { $_ -ne $serviceSid }) -join ',') -ne (@($baseline[$right] | Where-Object { $_ -ne $serviceSid }) -join ',')) { throw "Other account policy changed for $right" }
+}
+# Simulate pre-existing policy on this dedicated account. Installation may only
+# record/revoke its own additions. Preserve the original baseline on cleanup.
+$seed = [DshBrokerRights]::Install($serviceSid)
+[DshBrokerRights]::Remove($serviceSid, [string[]]@($seed | Where-Object { $_ -ne 'SeServiceLogonRight' }))
+try {
+    # Inject each post-grant failure through PowerShell's command resolution.
+    # Include a partial staging record, then verify actual LSA policy and SCM.
+    foreach ($step in @('Set-Content', 'Move-Item', 'Start-Service')) {
+        Set-Item -Path "Function:$step" -Value {
+            Microsoft.PowerShell.Management\Set-Content -LiteralPath "$record.pending" -Value '['
+            throw 'Injected installation failure'
+        }
+        $failed = $false
+        try { & $installer }
+        catch {
+            if ($_.Exception.Message -notlike '*Injected installation failure*') { throw }
+            $failed = $true
+        } finally { Remove-Item -Path "Function:$step" -Force }
+        if (-not $failed) { throw "Failure injection did not run: $step" }
+        Assert-Rights (Read-Policy) @($preexisting + 'SeServiceLogonRight')
+        if (Test-Path $record) { throw 'Rollback retained a committed rights record.' }
+        if (Test-Path "$record.pending") { throw 'Rollback retained a partial rights record.' }
+        if (Get-Service $name -ErrorAction SilentlyContinue) { throw 'Rollback retained the failed service.' }
+        Write-Output "Verified rollback after $step failure"
+    }
+    & $installer
+    Assert-Rights (Read-Policy) $required
+    if (@(Get-Content -Raw $record | ConvertFrom-Json) -contains 'SeServiceLogonRight') { throw 'Installer recorded a pre-existing right.' }
+    & $installer # Upgrade must preserve the same pre-existing right.
+    if (@(Get-Content -Raw $record | ConvertFrom-Json) -contains 'SeServiceLogonRight') { throw 'Upgrade recorded a pre-existing right.' }
+    & $installer -Uninstall
+    Assert-Rights (Read-Policy) @($preexisting + 'SeServiceLogonRight')
+} finally {
+    & $installer -Uninstall
+    if ($seed -contains 'SeServiceLogonRight') { [DshBrokerRights]::Remove($serviceSid, [string[]]@('SeServiceLogonRight')) }
+}
+Assert-Rights (Read-Policy) $preexisting
+& $installer
+Write-Output 'Broker lifecycle verified: install, upgrade, uninstall, pre-existing rights preserved; other accounts unchanged.'