Add packaged DLP broker and protected Windows service foundation

apps/inspector/provision_runtime_acl.py

@@ -7,10 +7,13 @@ import argparse
 import json
 from pathlib import Path
 import sys
+import os
+import threading
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 sys.dont_write_bytecode=True
 from windows_appcontainer import AppContainer, SandboxError
+from windows_containment import contain_inspector
 
 
 def main():
@@ -26,8 +29,21 @@ def main():
         raise SandboxError('Use the private Python belonging to this installation')
     roots = [source, runtime]
     if semantic.is_dir(): roots.append(semantic)
-    sandbox = AppContainer(roots, provision=args.provision)
-    print(json.dumps({'verified': True, 'provisioned': args.provision, 'rootCount': len(roots), 'profile': sandbox.name}))
+    deadline = None
+    if args.provision:
+        # Installer-only: closing/killing this process terminates grant children.
+        # nsExec's own timeout renews on output, so enforce our own hard deadline.
+        containment = contain_inspector()
+        if containment.get('active') is not True or containment.get('killsDescendants') is not True:
+            raise SandboxError('Installer resource containment unavailable')
+        deadline = threading.Timer(240, lambda: os._exit(2))
+        deadline.daemon = True
+        deadline.start()
+    try:
+        sandbox = AppContainer(roots, provision=args.provision)
+        print(json.dumps({'verified': True, 'provisioned': args.provision, 'rootCount': len(roots), 'profile': sandbox.name}))
+    finally:
+        if deadline is not None: deadline.cancel()
 
 
 if __name__ == '__main__':