A seed in a shared folder got the folder's list, and wai signed with it. Now the
seed, the record and a keystore wai makes have this account as owner and as their
one entry, with inheritance off, wherever they are. The call that makes the file
carries the list (CreateFileW with its security descriptor), so the secret never
exists on disk under anything wider, and no handle can be held open from a moment
when it did. Unix was already so: open with O_CREAT|O_EXCL and mode 0600. A test
now holds that too.
A seed whose list grants any other account anything, or that another account owns,
is refused with the same exit 3 and key-file-exposed as a wide mode on Unix, naming
the file, the accounts and the icacls command that fixes it. Everything is by SID,
read through the system's calls and never from icacls' output, which is localised.
SYSTEM and Administrators are not listed: a backup or a scanner reads through its
privileges rather than the list, an administrator can still take ownership, and the
account itself reads the file elevated or not.
All the unsafe code is in win_acl.rs, behind cfg(windows). What decides is ordinary
code over plain values, so its tests run on every system. windows-sys 0.61 was
already in all sixteen lockfiles that hold this crate; each gains one line.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
2aaac020d8