windows-development-sandbox 1.13.0 → 1.14.0

package/native/csharp/HcsHost/AssemblyInfo.cs

@@ -8,9 +8,9 @@ using System.Runtime.InteropServices;
 [assembly: AssemblyCompany("windows-development-sandbox (open source)")]
 [assembly: AssemblyProduct("Windows Development Sandbox")]
 [assembly: AssemblyCopyright("MIT License, windows-development-sandbox contributors")]
-[assembly: AssemblyVersion("1.12.0.0")]
-[assembly: AssemblyFileVersion("1.12.0.0")]
-[assembly: AssemblyInformationalVersion("1.12.0")]
+[assembly: AssemblyVersion("1.14.0.0")]
+[assembly: AssemblyFileVersion("1.14.0.0")]
+[assembly: AssemblyInformationalVersion("1.14.0")]
 [assembly: ComVisible(false)]
 // computecore.dll and computestorage.dll are not KnownDLLs: load them from System32 only, never from the exe's folder.
 [assembly: DefaultDllImportSearchPaths(DllImportSearchPath.System32)]

package/native/csharp/HostTools/AssemblyInfo.cs

@@ -8,7 +8,7 @@ using System.Runtime.InteropServices;
 [assembly: AssemblyCompany("windows-development-sandbox (open source)")]
 [assembly: AssemblyProduct("Windows Development Sandbox")]
 [assembly: AssemblyCopyright("MIT License, windows-development-sandbox contributors")]
-[assembly: AssemblyVersion("1.12.0.0")]
-[assembly: AssemblyFileVersion("1.12.0.0")]
-[assembly: AssemblyInformationalVersion("1.12.0")]
+[assembly: AssemblyVersion("1.14.0.0")]
+[assembly: AssemblyFileVersion("1.14.0.0")]
+[assembly: AssemblyInformationalVersion("1.14.0")]
 [assembly: ComVisible(false)]

package/native/csharp/StorageHelper/AssemblyInfo.cs

@@ -0,0 +1,15 @@
+// What AgentSandboxStorage.exe says about itself in its file properties (publisher, product, description, version), so
+// Windows, antivirus software and you can tell what it is. It is built by the all-users installer from the sources next
+// to this file, into the Program Files install folder.
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyTitle("Windows Development Sandbox storage helper")]
+[assembly: AssemblyDescription("Service of windows-development-sandbox (open source, MIT): mounts and dismounts a user's contained-storage disk image without a permission prompt, after checking it is that user's own image in that user's own folder. Source: https://github.com/JoshDiDuca/windows-development-sandbox")]
+[assembly: AssemblyCompany("windows-development-sandbox (open source)")]
+[assembly: AssemblyProduct("Windows Development Sandbox")]
+[assembly: AssemblyCopyright("MIT License, windows-development-sandbox contributors")]
+[assembly: AssemblyVersion("1.14.0.0")]
+[assembly: AssemblyFileVersion("1.14.0.0")]
+[assembly: AssemblyInformationalVersion("1.14.0")]
+[assembly: ComVisible(false)]

package/native/csharp/StorageHelper/Client.cs

@@ -0,0 +1,297 @@
+// Who is on the other end of the pipe, from Windows and never from the message: the token of the connected client
+// (ImpersonateNamedPipeClient, taken and reverted at once), checked to be a real interactive user (impersonation level,
+// not anonymous or a service account, medium integrity or higher, not an app container or restricted token, a member
+// of the "Agent Sandbox Users" group or Administrators), and the client process (GetNamedPipeClientProcessId), whose
+// user must be the same. The token is kept only to read that user's settings file and environment.
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+namespace AgentSandbox.StorageHelper
+{
+    public sealed class Client : IDisposable
+    {
+        private const uint TokenQuery = 0x0008;
+        private const uint TokenDuplicate = 0x0002;
+        private const uint TokenImpersonate = 0x0004;
+        private const int TokenUserClass = 1;
+        private const int TokenImpersonationLevelClass = 9;
+        private const int TokenIntegrityLevelClass = 25;
+        private const int TokenIsAppContainerClass = 29;
+        private const int SecurityImpersonation = 2;
+        private const int MediumIntegrity = 0x2000;
+        private const uint ProcessQueryLimited = 0x1000;
+        private static readonly string[] ServiceAccounts = { "S-1-5-7", "S-1-5-18", "S-1-5-19", "S-1-5-20" };
+        private static readonly SecurityIdentifier Administrators = new SecurityIdentifier("S-1-5-32-544");
+
+        private Client(SafeAccessTokenHandle token, SecurityIdentifier sid, int pid, string program)
+        {
+            Token = token;
+            Sid = sid;
+            Pid = pid;
+            Program = program;
+        }
+
+        public SafeAccessTokenHandle Token { get; private set; }
+        public SecurityIdentifier Sid { get; private set; }
+        public int Pid { get; private set; }
+        public string Program { get; private set; }
+
+        public string Account
+        {
+            get
+            {
+                try
+                {
+                    return Sid.Translate(typeof(NTAccount)).Value;
+                }
+                catch (Exception)
+                {
+                    return "";
+                }
+            }
+        }
+
+        private static class NativeMethods
+        {
+            [DllImport("kernel32.dll", SetLastError = true)]
+            [return: MarshalAs(UnmanagedType.Bool)]
+            public static extern bool GetNamedPipeClientProcessId(SafeHandle pipe, out uint processId);
+
+            [DllImport("advapi32.dll", SetLastError = true)]
+            [return: MarshalAs(UnmanagedType.Bool)]
+            public static extern bool ImpersonateNamedPipeClient(SafeHandle pipe);
+
+            [DllImport("advapi32.dll", SetLastError = true)]
+            [return: MarshalAs(UnmanagedType.Bool)]
+            public static extern bool RevertToSelf();
+
+            [DllImport("kernel32.dll")]
+            public static extern IntPtr GetCurrentThread();
+
+            [DllImport("advapi32.dll", SetLastError = true)]
+            [return: MarshalAs(UnmanagedType.Bool)]
+            public static extern bool OpenThreadToken(IntPtr thread, uint access, [MarshalAs(UnmanagedType.Bool)] bool openAsSelf, out SafeAccessTokenHandle token);
+
+            [DllImport("advapi32.dll", SetLastError = true)]
+            [return: MarshalAs(UnmanagedType.Bool)]
+            public static extern bool GetTokenInformation(SafeAccessTokenHandle token, int infoClass, byte[] info, int length, out int returned);
+
+            [DllImport("advapi32.dll", EntryPoint = "GetTokenInformation", SetLastError = true)]
+            [return: MarshalAs(UnmanagedType.Bool)]
+            public static extern bool GetTokenInformationPtr(SafeAccessTokenHandle token, int infoClass, IntPtr info, int length, out int returned);
+
+            [DllImport("advapi32.dll", SetLastError = true)]
+            [return: MarshalAs(UnmanagedType.Bool)]
+            public static extern bool IsTokenRestricted(SafeAccessTokenHandle token);
+
+            [DllImport("advapi32.dll", SetLastError = true)]
+            [return: MarshalAs(UnmanagedType.Bool)]
+            public static extern bool CheckTokenMembership(SafeAccessTokenHandle token, byte[] sid, [MarshalAs(UnmanagedType.Bool)] out bool isMember);
+
+            [DllImport("kernel32.dll", SetLastError = true)]
+            public static extern IntPtr OpenProcess(uint access, [MarshalAs(UnmanagedType.Bool)] bool inherit, uint processId);
+
+            [DllImport("advapi32.dll", SetLastError = true)]
+            [return: MarshalAs(UnmanagedType.Bool)]
+            public static extern bool OpenProcessToken(IntPtr process, uint access, out SafeAccessTokenHandle token);
+
+            [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+            [return: MarshalAs(UnmanagedType.Bool)]
+            public static extern bool QueryFullProcessImageNameW(IntPtr process, uint flags, StringBuilder name, ref uint size);
+
+            [DllImport("kernel32.dll", SetLastError = true)]
+            [return: MarshalAs(UnmanagedType.Bool)]
+            public static extern bool CloseHandle(IntPtr handle);
+        }
+
+        /// <summary>
+        /// The user of the process at the other end of the pipe, before anything is read (to count connections): its
+        /// SID, or "pid:N" when it cannot be told. Only for counting; never for deciding who the caller is.
+        /// </summary>
+        public static string ProcessUserOf(SafeHandle pipe)
+        {
+            uint pid;
+            if (!NativeMethods.GetNamedPipeClientProcessId(pipe, out pid))
+            {
+                return "unknown";
+            }
+            string program;
+            SecurityIdentifier user = ProcessUser(pid, out program);
+            return user == null ? "pid:" + pid : user.Value;
+        }
+
+        /// <summary>The checked client of a pipe that has already received the request (impersonation needs that).</summary>
+        public static Client Of(SafeHandle h, SecurityIdentifier group)
+        {
+            uint pid;
+            if (!NativeMethods.GetNamedPipeClientProcessId(h, out pid))
+            {
+                throw Win32.LastError("Could not tell which program is calling");
+            }
+            SafeAccessTokenHandle token;
+            if (!NativeMethods.ImpersonateNamedPipeClient(h))
+            {
+                throw Win32.LastError("Could not tell who is calling");
+            }
+            try
+            {
+                if (!NativeMethods.OpenThreadToken(NativeMethods.GetCurrentThread(), TokenQuery | TokenDuplicate | TokenImpersonate, true, out token))
+                {
+                    throw Win32.LastError("Could not tell who is calling");
+                }
+            }
+            finally
+            {
+                if (!NativeMethods.RevertToSelf())
+                {
+                    // Running on as the caller would be worse than stopping: end the service.
+                    Environment.FailFast("RevertToSelf failed");
+                }
+            }
+            try
+            {
+                SecurityIdentifier sid = Check(token, group);
+                string program;
+                SecurityIdentifier processUser = ProcessUser(pid, out program);
+                if (processUser == null || !processUser.Equals(sid))
+                {
+                    throw new RefusedException("The calling program does not run as the user who called.");
+                }
+                return new Client(token, sid, (int)pid, program);
+            }
+            catch
+            {
+                token.Dispose();
+                throw;
+            }
+        }
+
+        /// <summary>The user of a token that may use this service, or an exception that says why not.</summary>
+        public static SecurityIdentifier Check(SafeAccessTokenHandle token, SecurityIdentifier group)
+        {
+            byte[] level = Info(token, TokenImpersonationLevelClass);
+            if (BitConverter.ToInt32(level, 0) < SecurityImpersonation)
+            {
+                throw new RefusedException("The caller did not allow the service to act as them.");
+            }
+            SecurityIdentifier sid = SidIn(token, TokenUserClass);
+            if (Array.IndexOf(ServiceAccounts, sid.Value) >= 0 || sid.IsWellKnown(WellKnownSidType.AnonymousSid))
+            {
+                throw new RefusedException("Service accounts cannot use contained storage.");
+            }
+            SecurityIdentifier label = SidIn(token, TokenIntegrityLevelClass);
+            byte[] labelBytes = new byte[label.BinaryLength];
+            label.GetBinaryForm(labelBytes, 0);
+            int rid = BitConverter.ToInt32(labelBytes, labelBytes.Length - 4);
+            if (rid < MediumIntegrity)
+            {
+                throw new RefusedException("A program at low integrity cannot use contained storage.");
+            }
+            if (BitConverter.ToInt32(Info(token, TokenIsAppContainerClass), 0) != 0)
+            {
+                throw new RefusedException("An app container cannot use contained storage.");
+            }
+            if (NativeMethods.IsTokenRestricted(token))
+            {
+                throw new RefusedException("A restricted program cannot use contained storage.");
+            }
+            if (!IsMember(token, group) && !IsMember(token, Administrators))
+            {
+                throw new RefusedException("Only members of the Agent Sandbox Users group may use this (sign out and in after being added).");
+            }
+            return sid;
+        }
+
+        private static bool IsMember(SafeAccessTokenHandle token, SecurityIdentifier sid)
+        {
+            if (sid == null)
+            {
+                return false;
+            }
+            byte[] bytes = new byte[sid.BinaryLength];
+            sid.GetBinaryForm(bytes, 0);
+            bool member;
+            if (!NativeMethods.CheckTokenMembership(token, bytes, out member))
+            {
+                throw Win32.LastError("Could not check the caller's groups");
+            }
+            return member;
+        }
+
+        private static byte[] Info(SafeAccessTokenHandle token, int infoClass)
+        {
+            byte[] buffer = new byte[1024];
+            int returned;
+            if (!NativeMethods.GetTokenInformation(token, infoClass, buffer, buffer.Length, out returned))
+            {
+                throw Win32.LastError("Could not read the caller's token");
+            }
+            return buffer;
+        }
+
+        /// <summary>The SID of a TOKEN_USER or TOKEN_MANDATORY_LABEL (a SID_AND_ATTRIBUTES pointing into the same buffer).</summary>
+        private static SecurityIdentifier SidIn(SafeAccessTokenHandle token, int infoClass)
+        {
+            IntPtr buffer = Marshal.AllocHGlobal(1024);
+            try
+            {
+                int returned;
+                if (!NativeMethods.GetTokenInformationPtr(token, infoClass, buffer, 1024, out returned))
+                {
+                    throw Win32.LastError("Could not read the caller's token");
+                }
+                return new SecurityIdentifier(Marshal.ReadIntPtr(buffer));
+            }
+            finally
+            {
+                Marshal.FreeHGlobal(buffer);
+            }
+        }
+
+        private static SecurityIdentifier ProcessUser(uint pid, out string program)
+        {
+            program = "";
+            IntPtr process = NativeMethods.OpenProcess(ProcessQueryLimited, false, pid);
+            if (process == IntPtr.Zero)
+            {
+                return null;
+            }
+            try
+            {
+                StringBuilder name = new StringBuilder(1024);
+                uint size = (uint)name.Capacity;
+                if (NativeMethods.QueryFullProcessImageNameW(process, 0, name, ref size))
+                {
+                    program = name.ToString();
+                }
+                SafeAccessTokenHandle token;
+                if (!NativeMethods.OpenProcessToken(process, TokenQuery, out token))
+                {
+                    return null;
+                }
+                using (token)
+                {
+                    return UserOf(token);
+                }
+            }
+            finally
+            {
+                NativeMethods.CloseHandle(process);
+            }
+        }
+
+        public static SecurityIdentifier UserOf(SafeAccessTokenHandle token)
+        {
+            return new WindowsIdentity(token.DangerousGetHandle()).User;
+        }
+
+        public void Dispose()
+        {
+            Token.Dispose();
+        }
+    }
+}

package/native/csharp/StorageHelper/Log.cs

@@ -0,0 +1,177 @@
+// The service's log: one line per call (when, who, what, the result), in %ProgramData%\AgentSandbox\logs\
+// storage-helper.log. The folder must belong to administrators with nobody else allowed to change it, and must be
+// exactly where it says (no link on the way); otherwise the service does not start, since it writes there as SYSTEM.
+// The file is opened without following links and must have one name only; past 1 MB it is renamed (by its handle) to
+// storage-helper.log.1. Text from outside (a set name, a path, a reason) is reduced to printable ASCII first. Writing
+// never throws: a full disk must not change what a call does.
+using System;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Security.AccessControl;
+using System.Security.Principal;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+
+namespace AgentSandbox.StorageHelper
+{
+    public sealed class Log
+    {
+        private const long MaxBytes = 1024 * 1024;
+        private const uint OpenAlways = 4;
+        private const uint FileAppendData = 0x0004;
+        private const int FileRenameInfoClass = 3;
+        private static readonly SecurityIdentifier SystemSid = new SecurityIdentifier("S-1-5-18");
+        private static readonly SecurityIdentifier AdministratorsSid = new SecurityIdentifier("S-1-5-32-544");
+        private readonly object gate = new object();
+        private readonly string file;
+
+        private Log(string file)
+        {
+            this.file = file;
+        }
+
+        private static class NativeMethods
+        {
+            [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+            public static extern SafeFileHandle CreateFileW(string fileName, uint access, uint share, IntPtr security, uint creation, uint flags, IntPtr template);
+
+            [DllImport("kernel32.dll", SetLastError = true)]
+            [return: MarshalAs(UnmanagedType.Bool)]
+            public static extern bool SetFileInformationByHandle(SafeFileHandle file, int infoClass, byte[] info, int size);
+        }
+
+        /// <summary>The log in this folder (made, admin-only, when missing). Throws when the folder is not safe to write as SYSTEM.</summary>
+        public static Log InFolder(string folder, bool requireAdminOnly)
+        {
+            if (!Directory.Exists(folder))
+            {
+                DirectorySecurity security = new DirectorySecurity();
+                security.SetAccessRuleProtection(true, false);
+                security.AddAccessRule(new FileSystemAccessRule(SystemSid, FileSystemRights.FullControl, InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, PropagationFlags.None, AccessControlType.Allow));
+                security.AddAccessRule(new FileSystemAccessRule(AdministratorsSid, FileSystemRights.FullControl, InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit, PropagationFlags.None, AccessControlType.Allow));
+                Directory.CreateDirectory(folder, security);
+            }
+            using (SafeFileHandle h = Win32.OpenNoFollow(folder, Win32.ReadControl | Win32.FileReadAttributes | Win32.Synchronize, Win32.FileShareRead | Win32.FileShareWrite))
+            {
+                if (h == null)
+                {
+                    throw new IOException("The log folder could not be made: " + folder);
+                }
+                Win32.ByHandleFileInformation info = Win32.InfoOf(h, folder);
+                if ((info.FileAttributes & Win32.AttributeReparsePoint) != 0 || !Win32.IsAt(h, folder))
+                {
+                    throw new IOException("The log folder is a link or behind one: " + folder);
+                }
+                if (requireAdminOnly)
+                {
+                    RawSecurityDescriptor sd = Win32.SecurityOf(h);
+                    bool adminOwned = sd.Owner != null && (sd.Owner.Equals(SystemSid) || sd.Owner.Equals(AdministratorsSid));
+                    if (!adminOwned || Pins.OthersWhoMayChange(sd, SystemSid) != null)
+                    {
+                        throw new IOException("Someone who is not an administrator may change the log folder " + folder + "; run the installer again.");
+                    }
+                }
+            }
+            return new Log(Path.Combine(folder, "storage-helper.log"));
+        }
+
+        public string File
+        {
+            get { return file; }
+        }
+
+        public void Write(string sid, string account, int pid, string program, string verb, string set, string result)
+        {
+            string line = Now() +
+                " sid=" + Safe.Text(sid, 200) +
+                " user=" + Quote(account, 200) +
+                " pid=" + pid +
+                " program=" + Quote(program, 300) +
+                " verb=" + Safe.Text(verb, 20) +
+                " set=" + Quote(set, 80) +
+                " result=" + Quote(result, 600);
+            Append(line);
+        }
+
+        public void Note(string text)
+        {
+            Append(Now() + " " + Quote(text, 600));
+        }
+
+        private static string Now()
+        {
+            return DateTime.UtcNow.ToString("yyyy-MM-ddTHH:mm:ss.fffZ");
+        }
+
+        private static string Quote(string text, int max)
+        {
+            return "\"" + Safe.Text(text, max).Replace("\"", "'") + "\"";
+        }
+
+        private void Append(string line)
+        {
+            lock (gate)
+            {
+                try
+                {
+                    using (SafeFileHandle h = OpenLog(FileAppendData | Win32.FileReadAttributes | Win32.Synchronize | Win32.Delete))
+                    {
+                        Win32.ByHandleFileInformation info = Win32.InfoOf(h, file);
+                        long size = ((long)info.FileSizeHigh << 32) | info.FileSizeLow;
+                        if (size > MaxBytes)
+                        {
+                            RenameTo(h, file + ".1");
+                        }
+                    }
+                    using (SafeFileHandle h = OpenLog(FileAppendData | Win32.FileReadAttributes | Win32.Synchronize))
+                    using (FileStream stream = new FileStream(h, FileAccess.Write))
+                    {
+                        byte[] bytes = Encoding.ASCII.GetBytes(line + "\r\n");
+                        stream.Seek(0, SeekOrigin.End);
+                        stream.Write(bytes, 0, bytes.Length);
+                    }
+                }
+                catch (Exception)
+                {
+                    // The log is a record, not a gate: a full disk or a locked file must not change what the call does.
+                }
+            }
+        }
+
+        /// <summary>The log file, made when missing, never through a link, never a file with a second name.</summary>
+        private SafeFileHandle OpenLog(uint access)
+        {
+            SafeFileHandle h = NativeMethods.CreateFileW(file, access, Win32.FileShareRead, IntPtr.Zero, OpenAlways, Win32.FlagOpenReparsePoint, IntPtr.Zero);
+            if (h.IsInvalid)
+            {
+                Win32Exception e = Win32.LastError("Could not open the log");
+                h.Dispose();
+                throw e;
+            }
+            Win32.ByHandleFileInformation info = Win32.InfoOf(h, file);
+            if ((info.FileAttributes & (Win32.AttributeReparsePoint | Win32.AttributeDirectory)) != 0 || info.NumberOfLinks != 1)
+            {
+                h.Dispose();
+                throw new IOException("The log is a link or has a second name; not writing to it.");
+            }
+            return h;
+        }
+
+        private static void RenameTo(SafeFileHandle h, string target)
+        {
+            // FILE_RENAME_INFO: BOOLEAN ReplaceIfExists; HANDLE RootDirectory; DWORD FileNameLength; WCHAR FileName[].
+            byte[] name = Encoding.Unicode.GetBytes(target);
+            int pointer = IntPtr.Size;
+            int nameOffset = pointer * 2 + 4;
+            byte[] info = new byte[nameOffset + name.Length + 2];
+            info[0] = 1;
+            BitConverter.GetBytes(name.Length).CopyTo(info, pointer * 2);
+            name.CopyTo(info, nameOffset);
+            if (!NativeMethods.SetFileInformationByHandle(h, FileRenameInfoClass, info, info.Length))
+            {
+                throw Win32.LastError("Could not rotate the log");
+            }
+        }
+    }
+}

package/native/csharp/StorageHelper/MountRecords.cs

@@ -0,0 +1,160 @@
+// What the service has mounted, so nothing is left behind: one line per mount (user SID, storage folder, data set) in
+// %ProgramData%\AgentSandbox\storage-helper\mounts.txt, a folder only administrators may change. When the service starts
+// it takes off mount points whose disk is gone (the PC restarted while mounted; the Windows permission prompt's script
+// would otherwise find a stale mount point), and uninstalling runs `release-all`, which dismounts every recorded set with
+// the usual checks. The file is only ever read and written by this service as SYSTEM.
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Security.Principal;
+using System.Text;
+
+namespace AgentSandbox.StorageHelper
+{
+    public sealed class MountRecord
+    {
+        public MountRecord(string sid, string storageRoot, string set)
+        {
+            Sid = sid;
+            StorageRoot = storageRoot;
+            Set = set;
+        }
+
+        public string Sid { get; private set; }
+        public string StorageRoot { get; private set; }
+        public string Set { get; private set; }
+
+        public string Key
+        {
+            get { return (Sid + "\t" + StorageRoot + "\t" + Set).ToUpperInvariant(); }
+        }
+    }
+
+    public sealed class MountRecords
+    {
+        private const int MaxRecords = 1000;
+        private const int MaxPerUser = 8;
+        private readonly object gate = new object();
+        private readonly string file;
+
+        public MountRecords(string folder)
+        {
+            // Checked like the log folder: administrators only, no link on the way.
+            Log.InFolder(folder, true);
+            file = Path.Combine(folder, "mounts.txt");
+        }
+
+        public List<MountRecord> Read()
+        {
+            lock (gate)
+            {
+                List<MountRecord> records = new List<MountRecord>();
+                if (!File.Exists(file))
+                {
+                    return records;
+                }
+                foreach (string line in File.ReadAllLines(file, Encoding.UTF8))
+                {
+                    string[] parts = line.Split('\t');
+                    if (parts.Length != 3 || !Rules.IsSetName(parts[2]) || !Rules.IsPlainAbsolute(parts[1]))
+                    {
+                        continue;
+                    }
+                    try
+                    {
+                        new SecurityIdentifier(parts[0]);
+                    }
+                    catch (ArgumentException)
+                    {
+                        continue;
+                    }
+                    records.Add(new MountRecord(parts[0], parts[1], parts[2]));
+                    if (records.Count >= MaxRecords)
+                    {
+                        break;
+                    }
+                }
+                return records;
+            }
+        }
+
+        /// <summary>True when this record is there already or there is room for it (at most 8 per user, 1000 in all).</summary>
+        public bool HasRoomFor(MountRecord record)
+        {
+            lock (gate)
+            {
+                int mine = 0;
+                List<MountRecord> records = Read();
+                foreach (MountRecord r in records)
+                {
+                    if (r.Key == record.Key)
+                    {
+                        return true;
+                    }
+                    if (string.Equals(r.Sid, record.Sid, StringComparison.OrdinalIgnoreCase))
+                    {
+                        mine++;
+                    }
+                }
+                return mine < MaxPerUser && records.Count < MaxRecords;
+            }
+        }
+
+        public void Add(MountRecord record)
+        {
+            lock (gate)
+            {
+                List<MountRecord> records = Read();
+                foreach (MountRecord r in records)
+                {
+                    if (r.Key == record.Key)
+                    {
+                        return;
+                    }
+                }
+                records.Add(record);
+                Save(records);
+            }
+        }
+
+        public void Remove(MountRecord record)
+        {
+            lock (gate)
+            {
+                List<MountRecord> kept = new List<MountRecord>();
+                foreach (MountRecord r in Read())
+                {
+                    if (r.Key != record.Key)
+                    {
+                        kept.Add(r);
+                    }
+                }
+                Save(kept);
+            }
+        }
+
+        private void Save(List<MountRecord> records)
+        {
+            StringBuilder sb = new StringBuilder();
+            int count = 0;
+            foreach (MountRecord r in records)
+            {
+                if (count++ >= MaxRecords)
+                {
+                    break;
+                }
+                sb.Append(r.Sid).Append('\t').Append(r.StorageRoot).Append('\t').Append(r.Set).Append("\r\n");
+            }
+            string temp = file + ".tmp";
+            File.WriteAllText(temp, sb.ToString(), new UTF8Encoding(false));
+            if (File.Exists(file))
+            {
+                File.Replace(temp, file, null);
+            }
+            else
+            {
+                File.Move(temp, file);
+            }
+        }
+    }
+}