Add packaged DLP broker and protected Windows service foundation

apps/inspector/dpapi.py

@@ -24,10 +24,15 @@ def convert(data,protect):
 if __name__=='__main__':
     try:
         if sys.platform!='win32' or len(sys.argv)!=2 or sys.argv[1] not in ['protect','unprotect']: raise ValueError()
-        data=sys.stdin.buffer.read(32769)
-        if not data or len(data)>32768:raise ValueError()
+        limit=32768 if sys.argv[1]=='protect' else 65536
+        data=sys.stdin.buffer.read(limit+1)
+        if not data or len(data)>limit:raise ValueError()
         if sys.argv[1]=='protect':output=base64.b64encode(convert(data,True))
-        else:output=convert(base64.b64decode(data,validate=True),False)
+        else:
+            decoded=base64.b64decode(data,validate=True)
+            if base64.b64encode(decoded)!=data:raise ValueError()
+            output=convert(decoded,False)
+        if len(output)>(65536 if sys.argv[1]=='protect' else 32768):raise ValueError()
         sys.stdout.buffer.write(output)
     except Exception:
         sys.stderr.write('Windows capability protection failed.\n');sys.exit(1)

apps/inspector/provision_runtime_acl.py

@@ -7,10 +7,13 @@ import argparse
 import json
 from pathlib import Path
 import sys
+import os
+import threading
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 sys.dont_write_bytecode=True
 from windows_appcontainer import AppContainer, SandboxError
+from windows_containment import contain_inspector
 
 
 def main():
@@ -26,8 +29,21 @@ def main():
         raise SandboxError('Use the private Python belonging to this installation')
     roots = [source, runtime]
     if semantic.is_dir(): roots.append(semantic)
-    sandbox = AppContainer(roots, provision=args.provision)
-    print(json.dumps({'verified': True, 'provisioned': args.provision, 'rootCount': len(roots), 'profile': sandbox.name}))
+    deadline = None
+    if args.provision:
+        # Installer-only: closing/killing this process terminates grant children.
+        # nsExec's own timeout renews on output, so enforce our own hard deadline.
+        containment = contain_inspector()
+        if containment.get('active') is not True or containment.get('killsDescendants') is not True:
+            raise SandboxError('Installer resource containment unavailable')
+        deadline = threading.Timer(240, lambda: os._exit(2))
+        deadline.daemon = True
+        deadline.start()
+    try:
+        sandbox = AppContainer(roots, provision=args.provision)
+        print(json.dumps({'verified': True, 'provisioned': args.provision, 'rootCount': len(roots), 'profile': sandbox.name}))
+    finally:
+        if deadline is not None: deadline.cancel()
 
 
 if __name__ == '__main__':