first commit

apps/inspector/provision_runtime_acl.py

@@ -0,0 +1,37 @@
+"""Installer-only ACL provisioning for this exact SafetyNet installation.
+
+Run with the installed private Python. No caller-controlled grant roots exist.
+Normal service startup verifies ACLs without changing them.
+"""
+import argparse
+import json
+from pathlib import Path
+import sys
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+sys.dont_write_bytecode=True
+from windows_appcontainer import AppContainer, SandboxError
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--provision', action='store_true', help='Installer/owner only: establish read/execute ACLs')
+    args = parser.parse_args()
+    source = Path(__file__).absolute().parent
+    development = source.parent.name == 'apps'
+    installation = source.parent.parent if development else source.parent
+    runtime = installation / ('.runtime/windows/python' if development else 'python')
+    semantic = installation / ('.runtime/windows/semantic' if development else 'semantic')
+    if Path(sys.executable).resolve().parent != runtime.resolve():
+        raise SandboxError('Use the private Python belonging to this installation')
+    roots = [source, runtime]
+    if semantic.is_dir(): roots.append(semantic)
+    sandbox = AppContainer(roots, provision=args.provision)
+    print(json.dumps({'verified': True, 'provisioned': args.provision, 'rootCount': len(roots), 'profile': sandbox.name}))
+
+
+if __name__ == '__main__':
+    try: main()
+    except (SandboxError, OSError):
+        print('Approved installation ACL verification/provisioning failed.', file=sys.stderr)
+        raise SystemExit(1)