windows-development-sandbox 1.13.2 → 1.15.0

package/native/csharp/HcsHost/Share.cs

@@ -1,8 +1,9 @@
-// Live folders (PROTOTYPE, not wired into the CLI; docs/design/hcs-live-folders.md): a vSMB share added to or removed
-// from a RUNNING compute system with HcsModifyComputeSystem. The request is built here from checked fields, never
-// passed through: only ResourcePath "VirtualMachine/Devices/VirtualSmb/Shares", only Add or Remove, a share name with
-// this tool's prefix, and fixed options (NoDirectmap always; read-only unless asked; never TakeBackupPrivilege,
-// UseShareRootIdentity, AllowedFiles or any other option that changes whose rights the guest uses).
+// Live folders (docs/design/hcs-live-folders.md): a vSMB share added to or removed from a RUNNING compute system with
+// HcsModifyComputeSystem. The request is built here from checked fields, never passed through: only ResourcePath
+// "VirtualMachine/Devices/VirtualSmb/Shares", only Add or Remove, a share name with this tool's prefix, and fixed
+// options (NoDirectmap always; read-only unless asked; never TakeBackupPrivilege, UseShareRootIdentity, AllowedFiles or
+// any other option that changes whose rights the guest uses). `share` uses it on our own systems, `wsb-share` on the
+// running Windows Sandbox (WsbShare.cs).
 using System;
 using System.Collections.Generic;
 using System.IO;
@@ -25,9 +26,23 @@ namespace AgentSandbox.HcsHost
         public string Name;
         public string Path;
         public bool ReadOnly = true;
+        /// <summary>wsb-share: this tool's storage and data folders, never shared (the data folder holds secrets\).</summary>
+        public string StorageRoot;
+        public string DataPath;
+        /// <summary>wsb-share: the Windows user who asked (must be the one running HcsHost: no other account's prompt).</summary>
+        public string UserSid;
 
         /// <summary>Reads and checks a request file. Null with `problem` set when it is not allowed.</summary>
         public static ShareRequest Read(string file, out string problem)
+        {
+            return Read(file, null, out problem);
+        }
+
+        /// <summary>
+        /// The same, and when `sha256` is given the exact bytes parsed must have that SHA-256 (a file swapped after the
+        /// elevated script checked it is caught here).
+        /// </summary>
+        public static ShareRequest Read(string file, string sha256, out string problem)
         {
             FileInfo info = new FileInfo(file);
             if (!info.Exists || info.Length > MaxRequestBytes)
@@ -35,10 +50,27 @@ namespace AgentSandbox.HcsHost
                 problem = "the request must be a file of at most 64 KB";
                 return null;
             }
+            byte[] bytes = File.ReadAllBytes(file);
+            if (bytes.Length > MaxRequestBytes)
+            {
+                problem = "the request must be a file of at most 64 KB";
+                return null;
+            }
+            if (sha256 != null && !string.Equals(Sha256Hex(bytes), sha256, StringComparison.OrdinalIgnoreCase))
+            {
+                problem = "the request file changed after it was checked";
+                return null;
+            }
             Dictionary<string, object> raw;
             try
             {
-                raw = new JavaScriptSerializer().Deserialize<Dictionary<string, object>>(File.ReadAllText(file, Encoding.UTF8));
+                string text = new UTF8Encoding(false, true).GetString(bytes).TrimStart('\uFEFF');
+                raw = new JavaScriptSerializer().Deserialize<Dictionary<string, object>>(text);
+            }
+            catch (DecoderFallbackException)
+            {
+                problem = "the request is not UTF-8";
+                return null;
             }
             catch (ArgumentException)
             {
@@ -55,6 +87,9 @@ namespace AgentSandbox.HcsHost
             string action = Text(raw, "action");
             r.Name = Text(raw, "name");
             r.Path = Text(raw, "path");
+            r.StorageRoot = Text(raw, "storageRoot");
+            r.DataPath = Text(raw, "dataPath");
+            r.UserSid = Text(raw, "userSid");
             object ro;
             if (raw != null && raw.TryGetValue("readOnly", out ro))
             {
@@ -80,6 +115,14 @@ namespace AgentSandbox.HcsHost
             return problem == null ? r : null;
         }
 
+        public static string Sha256Hex(byte[] bytes)
+        {
+            using (System.Security.Cryptography.SHA256 sha = System.Security.Cryptography.SHA256.Create())
+            {
+                return BitConverter.ToString(sha.ComputeHash(bytes)).Replace("-", "").ToLowerInvariant();
+            }
+        }
+
         private static string Text(Dictionary<string, object> raw, string key)
         {
             object value;
@@ -150,17 +193,27 @@ namespace AgentSandbox.HcsHost
         /// <summary>The ModifySettingRequest (HCS schema; learn.microsoft.com .../hcsmodifycomputesystem).</summary>
         public string ToModifySettingRequest()
         {
+            return Build(Add, Name, Add ? System.IO.Path.GetFullPath(Path.TrimEnd('\\')) : null, ReadOnly);
+        }
+
+        /// <summary>The one place a share request is written: the fixed resource path and options.</summary>
+        public static string Build(bool add, string name, string folder, bool readOnly)
+        {
+            if (name == null || !SafeName.IsMatch(name))
+            {
+                throw new ArgumentException("not one of this tool's share names");
+            }
             StringBuilder sb = new StringBuilder();
             sb.Append("{\"ResourcePath\":").Append(Json.Quote(ResourcePath));
-            sb.Append(",\"RequestType\":").Append(Json.Quote(Add ? "Add" : "Remove"));
-            sb.Append(",\"Settings\":{\"Name\":").Append(Json.Quote(Name));
-            if (Add)
+            sb.Append(",\"RequestType\":").Append(Json.Quote(add ? "Add" : "Remove"));
+            sb.Append(",\"Settings\":{\"Name\":").Append(Json.Quote(name));
+            if (add)
             {
-                sb.Append(",\"Path\":").Append(Json.Quote(System.IO.Path.GetFullPath(Path.TrimEnd('\\'))));
+                sb.Append(",\"Path\":").Append(Json.Quote(folder));
                 // hcsshim's read-only defaults (internal/uvm/vsmb.go DefaultVSMBOptions) plus NoDirectmap: a share that
                 // was never direct-mapped can be removed again while the system runs.
                 sb.Append(",\"Options\":{\"NoDirectmap\":true");
-                if (ReadOnly)
+                if (readOnly)
                 {
                     sb.Append(",\"ReadOnly\":true,\"ShareRead\":true,\"CacheIo\":true,\"PseudoOplocks\":true");
                 }

package/native/csharp/HcsHost/WsbGuard.cs

@@ -0,0 +1,130 @@
+// The one exception to "only systems this tool created" (docs/design/hcs-live-folders.md, section 4): the wsb-share
+// verb may add a vSMB share to the running Windows Sandbox. It acts only when exactly one compute system is a running
+// VirtualMachine with a GUID id and an Owner from a fixed list, and that id is the one asked for. An unknown Owner,
+// none or two candidates (another user's sandbox, Application Guard) all fail closed. Ids with this tool's own prefix
+// are refused here, and `share` refuses GUIDs, so neither verb reaches the other's systems.
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.Text.RegularExpressions;
+using System.Web.Script.Serialization;
+
+namespace AgentSandbox.HcsHost
+{
+    public static class WsbGuard
+    {
+        /// <summary>The Owner Windows Sandbox's compute system is reported to have (unconfirmed: the PC test records it).</summary>
+        private static readonly string[] Owners = new string[] { "Madrid" };
+        private static readonly Regex GuidId = new Regex("^[0-9A-Fa-f]{8}-([0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}$");
+
+        /// <summary>Null when `id` has the shape of Windows Sandbox's id (a GUID, never one of ours).</summary>
+        public static string IdProblem(string id)
+        {
+            if (id == null || id.StartsWith(Guard.IdPrefix, StringComparison.OrdinalIgnoreCase) || !GuidId.IsMatch(id))
+            {
+                return "only the running Windows Sandbox (a GUID id) can be given a live folder";
+            }
+            return null;
+        }
+
+        /// <summary>One system from HCS JSON: its Id, SystemType, Owner and State ("" when missing).</summary>
+        private static string Field(Dictionary<string, object> s, string key)
+        {
+            object value;
+            return s != null && s.TryGetValue(key, out value) && value is string ? (string)value : "";
+        }
+
+        private static bool IsCandidate(Dictionary<string, object> s)
+        {
+            return Field(s, "SystemType") == "VirtualMachine" && Field(s, "State") == "Running" &&
+                Array.IndexOf(Owners, Field(s, "Owner")) >= 0 && GuidId.IsMatch(Field(s, "Id"));
+        }
+
+        /// <summary>
+        /// Pure: the Windows Sandbox candidate in HcsEnumerateComputeSystems' answer. Null (with `id`) when there is
+        /// exactly one; otherwise why not.
+        /// </summary>
+        public static string Candidate(string enumerateJson, out string id)
+        {
+            id = null;
+            object parsed;
+            try
+            {
+                parsed = new JavaScriptSerializer().DeserializeObject(enumerateJson ?? "");
+            }
+            catch (ArgumentException)
+            {
+                return "the list of compute systems is not JSON";
+            }
+            catch (InvalidOperationException)
+            {
+                return "the list of compute systems is not JSON";
+            }
+            IEnumerable systems = parsed as object[];
+            if (systems == null)
+            {
+                return "the list of compute systems is not a list";
+            }
+            List<string> found = new List<string>();
+            foreach (object o in systems)
+            {
+                Dictionary<string, object> s = o as Dictionary<string, object>;
+                if (IsCandidate(s))
+                {
+                    found.Add(Field(s, "Id"));
+                }
+            }
+            if (found.Count != 1)
+            {
+                return "exactly one running Windows Sandbox is needed, and " + found.Count + " were found (another user's sandbox or Application Guard counts too; a Windows Sandbox whose Owner is not " + string.Join(", ", Owners) + " is not recognised)";
+            }
+            id = found[0];
+            return null;
+        }
+
+        /// <summary>Pure: null when the candidate is the system asked for (case-insensitive GUIDs).</summary>
+        public static string MatchProblem(string candidate, string wanted)
+        {
+            if (wanted != null && wanted.Length > 0 && !string.Equals(candidate, wanted, StringComparison.OrdinalIgnoreCase))
+            {
+                return "the running Windows Sandbox is not the one this live folder was recorded for (it was restarted)";
+            }
+            return null;
+        }
+
+        /// <summary>Pure: null when an opened system's own properties still say it is the running Windows Sandbox `id`.</summary>
+        public static string PropertiesProblem(string propertiesJson, string id)
+        {
+            Dictionary<string, object> s;
+            try
+            {
+                s = new JavaScriptSerializer().Deserialize<Dictionary<string, object>>(propertiesJson ?? "");
+            }
+            catch (ArgumentException)
+            {
+                return "its properties are not JSON";
+            }
+            catch (InvalidOperationException)
+            {
+                return "its properties are not JSON";
+            }
+            if (!IsCandidate(s) || !string.Equals(Field(s, "Id"), id, StringComparison.OrdinalIgnoreCase))
+            {
+                return "the opened system is no longer the running Windows Sandbox";
+            }
+            return null;
+        }
+
+        /// <summary>Live: asks HCS for every system and finds Windows Sandbox (null with `id`, or why not).</summary>
+        public static string Find(out string id)
+        {
+            id = null;
+            HcsReply reply = Hcs.Enumerate(null);
+            if (!reply.Ok)
+            {
+                return "the compute systems could not be listed: " + reply.Message();
+            }
+            return Candidate(reply.Json, out id);
+        }
+    }
+}

package/native/csharp/HcsHost/WsbShare.cs

@@ -0,0 +1,295 @@
+// wsb-share (docs/design/hcs-live-folders.md): adds or removes one live folder on the running Windows Sandbox, run by
+// native\scripts\hcs-live-share.ps1 from an administrator-only copy of this exe. One process holds one handle to the
+// system for the whole add:
+//  1. the request (its exact bytes hashed and compared), the folder (FolderAccess) and the system (WsbGuard: exactly
+//     one candidate, the id asked for if one was recorded, its own properties re-read through the handle);
+//  2. a canary: a fresh folder next to this exe (Administrators, SYSTEM and the Virtual Machines group only) holding a
+//     random 128-bit token, shared read-only under a random name; canary.json in the request's folder tells the
+//     unelevated caller its name; the token our sandbox's daemon read from that share must come back in answer.txt
+//     within the time limit;
+//  3. only then the real folder is shared. The canary share and folder are always removed again.
+// It never terminates, pauses or saves the system, and every HCS operation waits at most 60 seconds.
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Security.AccessControl;
+using System.Security.Cryptography;
+using System.Security.Principal;
+using System.Text;
+using System.Text.RegularExpressions;
+using System.Threading;
+
+namespace AgentSandbox.HcsHost
+{
+    public static class WsbShare
+    {
+        private const uint OperationMs = 60000;
+        private const int CanaryWaitMs = 45000;
+        private const int PollMs = 250;
+        private const string CanaryFile = "canary.json";
+        private const string AnswerFile = "answer.txt";
+        private const string TokenFile = "token.txt";
+        private static readonly Regex Token = new Regex("^[0-9a-f]{32}$");
+        private static readonly SecurityIdentifier VirtualMachines = new SecurityIdentifier("S-1-5-83-0");
+
+        /// <summary>Adds or removes per the request; `values` say what happened (id, canary, the share request).</summary>
+        public static bool Run(string requestFile, string sha256, IDictionary<string, string> values, out string message)
+        {
+            string problem;
+            ShareRequest request = ShareRequest.Read(requestFile, sha256, out problem);
+            if (problem != null)
+            {
+                message = "Refused: " + problem;
+                return false;
+            }
+            // Elevated with another account's password (a standard user's prompt): the profile, access and ownership
+            // checks would be that account's, so it is refused. Live folders need your own administrator account.
+            string me = WindowsIdentity.GetCurrent().User.Value;
+            if (string.IsNullOrEmpty(request.UserSid) || !string.Equals(request.UserSid, me, StringComparison.OrdinalIgnoreCase))
+            {
+                message = "Refused: the permission prompt was answered with another account; live folders need your own administrator account";
+                return false;
+            }
+            string wanted = string.IsNullOrEmpty(request.Id) ? null : request.Id;
+            if (wanted != null && (problem = WsbGuard.IdProblem(wanted)) != null)
+            {
+                message = "Refused: " + problem;
+                return false;
+            }
+            if (!request.Add && wanted == null)
+            {
+                message = "Refused: a live folder is only removed from the sandbox it was added to (give its id)";
+                return false;
+            }
+            string folder = null;
+            IntPtr held = IntPtr.Zero;
+            if (request.Add && (problem = FolderAccess.Problem(request.Path, request.ReadOnly, request.StorageRoot, request.DataPath, out folder, out held)) != null)
+            {
+                message = "Refused: " + problem;
+                return false;
+            }
+            try
+            {
+                return WithFolder(request, requestFile, folder, held, wanted, values, out message);
+            }
+            finally
+            {
+                FolderAccess.Close(held);
+            }
+        }
+
+        /// <summary>The rest of Run, while the folder to share is held open (it cannot be renamed or replaced).</summary>
+        private static bool WithFolder(ShareRequest request, string requestFile, string folder, IntPtr held, string wanted, IDictionary<string, string> values, out string message)
+        {
+            string problem;
+            string id;
+            if ((problem = WsbGuard.Find(out id)) != null || (problem = WsbGuard.MatchProblem(id, wanted)) != null)
+            {
+                message = "Refused: " + problem;
+                return false;
+            }
+            values["id"] = id;
+            IntPtr system;
+            int hr = Hcs.Open(id, out system);
+            if (hr != 0)
+            {
+                HcsReply failed = new HcsReply();
+                failed.HResult = hr;
+                message = "Windows Sandbox could not be opened: " + failed.Message();
+                return false;
+            }
+            try
+            {
+                HcsReply props = Hcs.PropertiesOf(system);
+                if (!props.Ok || (problem = WsbGuard.PropertiesProblem(props.Json, id)) != null)
+                {
+                    message = "Refused: " + (problem ?? "its properties could not be read: " + props.Message());
+                    return false;
+                }
+                if (!request.Add)
+                {
+                    string remove = ShareRequest.Build(false, request.Name, null, true);
+                    values["request"] = remove;
+                    return Reply(Hcs.ModifyOn(system, remove, OperationMs), "removed", out message);
+                }
+                return AddWithCanary(system, request, folder, held, Path.GetDirectoryName(Path.GetFullPath(requestFile)), values, out message);
+            }
+            finally
+            {
+                Hcs.Close(system);
+            }
+        }
+
+        private static bool Reply(HcsReply reply, string done, out string message)
+        {
+            message = reply.Ok ? done : "The Host Compute Service said: " + reply.Message() + " (0x" + reply.HResult.ToString("X8") + ")";
+            return reply.Ok;
+        }
+
+        private static string RandomHex(int bytes)
+        {
+            byte[] b = new byte[bytes];
+            using (RandomNumberGenerator rng = RandomNumberGenerator.Create())
+            {
+                rng.GetBytes(b);
+            }
+            return BitConverter.ToString(b).Replace("-", "").ToLowerInvariant();
+        }
+
+        /// <summary>A new folder only Administrators, SYSTEM and the VM worker processes can use (made with that DACL).</summary>
+        private static string MakeCanaryFolder(string token)
+        {
+            string here = Path.GetDirectoryName(typeof(WsbShare).Assembly.Location);
+            string dir = Path.Combine(here, "canary-" + RandomHex(8));
+            if (Directory.Exists(dir) || File.Exists(dir))
+            {
+                throw new IOException("the canary folder exists already");
+            }
+            DirectorySecurity security = new DirectorySecurity();
+            security.SetAccessRuleProtection(true, false);
+            security.SetOwner(new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null));
+            InheritanceFlags inherit = InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit;
+            security.AddAccessRule(new FileSystemAccessRule(new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null), FileSystemRights.FullControl, inherit, PropagationFlags.None, AccessControlType.Allow));
+            security.AddAccessRule(new FileSystemAccessRule(new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null), FileSystemRights.FullControl, inherit, PropagationFlags.None, AccessControlType.Allow));
+            security.AddAccessRule(new FileSystemAccessRule(VirtualMachines, FileSystemRights.ReadAndExecute, inherit, PropagationFlags.None, AccessControlType.Allow));
+            Directory.CreateDirectory(dir, security);
+            File.WriteAllText(Path.Combine(dir, TokenFile), token, new UTF8Encoding(false));
+            return dir;
+        }
+
+        /// <summary>Writes a small file whole: a temp name first, then moved into place.</summary>
+        private static void WriteWhole(string file, string text)
+        {
+            // The caller's own temp folder: checked for a link right before writing, and only a new file is made there
+            // (never over an existing file or link).
+            string dir = Path.GetDirectoryName(file);
+            if ((File.GetAttributes(dir) & FileAttributes.ReparsePoint) != 0)
+            {
+                throw new IOException("the request folder became a link");
+            }
+            string temp = file + "." + RandomHex(4) + ".tmp";
+            byte[] bytes = new UTF8Encoding(false).GetBytes(text);
+            using (FileStream stream = new FileStream(temp, FileMode.CreateNew, FileAccess.Write, FileShare.None))
+            {
+                stream.Write(bytes, 0, bytes.Length);
+            }
+            File.Move(temp, file);
+        }
+
+        /// <summary>The token the caller relays from our sandbox's daemon (32 hex digits), or null until it is there.</summary>
+        private static string ReadAnswer(string file)
+        {
+            try
+            {
+                FileInfo info = new FileInfo(file);
+                if (!info.Exists || info.Length > 64)
+                {
+                    return null;
+                }
+                string text = File.ReadAllText(file, Encoding.ASCII).Trim();
+                return text.Length > 0 ? text : null;
+            }
+            catch (IOException)
+            {
+                return null; // still being written
+            }
+            catch (UnauthorizedAccessException)
+            {
+                return null;
+            }
+        }
+
+        private static bool FixedTimeEquals(string a, string b)
+        {
+            if (a == null || b == null || a.Length != b.Length)
+            {
+                return false;
+            }
+            int diff = 0;
+            for (int i = 0; i < a.Length; i++)
+            {
+                diff |= a[i] ^ b[i];
+            }
+            return diff == 0;
+        }
+
+        private static bool AddWithCanary(IntPtr system, ShareRequest request, string folder, IntPtr held, string exchange, IDictionary<string, string> values, out string message)
+        {
+            string token = RandomHex(16);
+            string canaryName = "agentsbx-" + RandomHex(8);
+            string canaryDir = null;
+            bool canaryAdded = false;
+            try
+            {
+                canaryDir = MakeCanaryFolder(token);
+                // Removed in finally even when the add fails: an add that timed out may still complete.
+                canaryAdded = true;
+                HcsReply added = Hcs.ModifyOn(system, ShareRequest.Build(true, canaryName, canaryDir, true), OperationMs);
+                if (!added.Ok)
+                {
+                    values["canary"] = "not added";
+                    return Reply(added, "", out message);
+                }
+                WriteWhole(Path.Combine(exchange, CanaryFile), "{\"share\":" + Json.Quote(canaryName) + "}");
+                string answer = null;
+                for (int waited = 0; waited < CanaryWaitMs && answer == null; waited += PollMs)
+                {
+                    Thread.Sleep(PollMs);
+                    answer = ReadAnswer(Path.Combine(exchange, AnswerFile));
+                }
+                if (answer == null || answer == "none")
+                {
+                    values["canary"] = answer == null ? "no answer" : "not read";
+                    message = "The sandbox did not read the test share" + (answer == null ? " in time" : "") + ", so this may not be your sandbox; nothing was shared";
+                    return false;
+                }
+                if (!Token.IsMatch(answer) || !FixedTimeEquals(answer, token))
+                {
+                    values["canary"] = "wrong token";
+                    message = "The test share came back with the wrong token, so this is not your sandbox; nothing was shared";
+                    return false;
+                }
+                values["canary"] = "matched";
+                string add = ShareRequest.Build(true, request.Name, folder, request.ReadOnly);
+                values["request"] = add;
+                HcsReply real = Hcs.ModifyOn(system, add, OperationMs);
+                string moved = real.Ok ? FolderAccess.MovedProblem(held, folder) : null;
+                if (!real.Ok || moved != null)
+                {
+                    // Failed, timed out (it may still complete) or the folder moved: the share is taken away again.
+                    HcsReply undone = Hcs.ModifyOn(system, ShareRequest.Build(false, request.Name, null, true), OperationMs);
+                    values["undone"] = undone.Ok ? "yes" : undone.Message();
+                    if (moved != null)
+                    {
+                        message = "Refused: " + moved;
+                        return false;
+                    }
+                }
+                return Reply(real, "added", out message);
+            }
+            finally
+            {
+                if (canaryAdded)
+                {
+                    HcsReply removed = Hcs.ModifyOn(system, ShareRequest.Build(false, canaryName, null, true), OperationMs);
+                    values["canaryRemoved"] = removed.Ok ? "yes" : removed.Message();
+                }
+                if (canaryDir != null)
+                {
+                    try
+                    {
+                        Directory.Delete(canaryDir, true);
+                    }
+                    catch (IOException)
+                    {
+                        // Still open by the VM: the elevated script deletes the whole work folder afterwards.
+                    }
+                    catch (UnauthorizedAccessException)
+                    {
+                        // The same.
+                    }
+                }
+            }
+        }
+    }
+}

package/native/csharp/HostTools/AssemblyInfo.cs

@@ -8,7 +8,7 @@ using System.Runtime.InteropServices;
 [assembly: AssemblyCompany("windows-development-sandbox (open source)")]
 [assembly: AssemblyProduct("Windows Development Sandbox")]
 [assembly: AssemblyCopyright("MIT License, windows-development-sandbox contributors")]
-[assembly: AssemblyVersion("1.13.2.0")]
-[assembly: AssemblyFileVersion("1.13.2.0")]
-[assembly: AssemblyInformationalVersion("1.13.2")]
+[assembly: AssemblyVersion("1.15.0.0")]
+[assembly: AssemblyFileVersion("1.15.0.0")]
+[assembly: AssemblyInformationalVersion("1.15.0")]
 [assembly: ComVisible(false)]

package/native/csharp/StorageHelper/AssemblyInfo.cs

@@ -0,0 +1,15 @@
+// What AgentSandboxStorage.exe says about itself in its file properties (publisher, product, description, version), so
+// Windows, antivirus software and you can tell what it is. It is built by the all-users installer from the sources next
+// to this file, into the Program Files install folder.
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyTitle("Windows Development Sandbox storage helper")]
+[assembly: AssemblyDescription("Service of windows-development-sandbox (open source, MIT): mounts and dismounts a user's contained-storage disk image without a permission prompt, after checking it is that user's own image in that user's own folder. Source: https://github.com/JoshDiDuca/windows-development-sandbox")]
+[assembly: AssemblyCompany("windows-development-sandbox (open source)")]
+[assembly: AssemblyProduct("Windows Development Sandbox")]
+[assembly: AssemblyCopyright("MIT License, windows-development-sandbox contributors")]
+[assembly: AssemblyVersion("1.15.0.0")]
+[assembly: AssemblyFileVersion("1.15.0.0")]
+[assembly: AssemblyInformationalVersion("1.15.0")]
+[assembly: ComVisible(false)]