Stabilize diagnostic export and preserve authorized policy continuity

scripts/debug-collector-acl.mjs

@@ -0,0 +1,32 @@
+import {spawnSync} from 'node:child_process';
+
+// Do not reapply ownership to an already private directory: Windows may require
+// restore privileges for SetOwner even when the current account already owns it.
+const command=`$ErrorActionPreference='Stop';
+$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User;
+function Test-PrivateAcl($acl){
+ if(-not $acl.AreAccessRulesProtected -or $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $sid.Value){return $false;}
+ $rules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]));
+ if($rules.Count -ne 1){return $false;}
+ $rule=$rules[0];
+ return (-not $rule.IsInherited -and $rule.IdentityReference.Value -eq $sid.Value -and $rule.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow -and $rule.FileSystemRights -eq [System.Security.AccessControl.FileSystemRights]::FullControl -and $rule.InheritanceFlags -eq ([System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit) -and $rule.PropagationFlags -eq [System.Security.AccessControl.PropagationFlags]::None);
+}
+$existing=Get-Acl -LiteralPath $env:SAFETYNET_COLLECTOR_DIRECTORY;
+$changed=$false;
+if(-not (Test-PrivateAcl $existing)){
+ $private=New-Object System.Security.AccessControl.DirectorySecurity;
+ $private.SetOwner($sid);$private.SetAccessRuleProtection($true,$false);
+ $private.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl','ContainerInherit,ObjectInherit','None','Allow')));
+ Set-Acl -LiteralPath $env:SAFETYNET_COLLECTOR_DIRECTORY -AclObject $private;
+ $changed=$true;
+}
+$verified=Get-Acl -LiteralPath $env:SAFETYNET_COLLECTOR_DIRECTORY;
+if(-not (Test-PrivateAcl $verified)){throw 'Collector directory protection verification failed';}
+@{verified=$true;changed=$changed}|ConvertTo-Json -Compress;`;
+export function protectCollectorDirectory(directory,{run=spawnSync}={}){
+ const result=run('powershell.exe',['-NoProfile','-NonInteractive','-Command',command],{windowsHide:true,timeout:10000,env:{SystemRoot:process.env.SystemRoot,SAFETYNET_COLLECTOR_DIRECTORY:directory},stdio:'pipe',encoding:'utf8'});
+ if(result.status!==0)throw Error('Collector directory protection failed');
+ let proof;try{proof=JSON.parse(result.stdout);}catch{throw Error('Collector directory protection verification failed');}
+ if(proof?.verified!==true||typeof proof.changed!=='boolean')throw Error('Collector directory protection verification failed');
+ return Object.freeze({verified:true,changed:proof.changed});
+}