feat(security): add a user-writable plugin ingest inbox for cross-account data

The LocalService runner can't traverse the interactive user's profile the way the old SYSTEM runner could — so a plugin can no longer read a file an app running as *you* produced (the acute case: the Playnite exporter's library JSON under %APPDATA%). Confirmed on-glass: as LocalService the glob finds nothing and the profile is un-traversable. Add the inverse of plugin-state: <config_dir>\ingest, granted BUILTIN\Users Modify by plugins enable (disable reverts to inherited Users:RX). An interactive-user app drops ingest\<plugin>\… and the de-privileged runner reads it there — the one Users-writable carve-out in the otherwise Users-read-only tree. SDK exports pluginIngestDir(name) to resolve it; on Linux the systemd --user runner owns the config dir so same-user producers write there with no grant. Accepted tradeoff: the inbox is writable by any local user (trusted-single- user model; it feeds only a LocalService runner). Consumers must treat ingest data as lower trust than their own state. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-20 00:35:47 +02:00
parent fdbfa37e43
commit e9a4c4a601
6 changed files with 122 additions and 1 deletions
@@ -146,6 +146,13 @@ if ($existing) {
    New-Item -ItemType Directory -Force -Path $stateDir | Out-Null
    & "$env:SystemRoot\System32\icacls.exe" $stateDir /grant:r '*S-1-5-19:(OI)(CI)(M)' | Out-Null
    if ($LASTEXITCODE -ne 0) { Write-Host "warn   : icacls grant failed on $stateDir" }
+    # Ingest inbox gets inheritable Modify for BUILTIN\Users - the INVERSE grant, so an
+    # interactive-user app (the Playnite exporter) can drop ingest\<plugin>\ data the LocalService
+    # runner reads. The one Users-writable carve-out in the otherwise Users-read-only tree.
+    $ingestDir = Join-Path $cfg 'ingest'
+    New-Item -ItemType Directory -Force -Path $ingestDir | Out-Null
+    & "$env:SystemRoot\System32\icacls.exe" $ingestDir /grant:r '*S-1-5-32-545:(OI)(CI)(M)' | Out-Null
+    if ($LASTEXITCODE -ne 0) { Write-Host "warn   : icacls grant failed on $ingestDir" }
 }

 # --- 4. the opt-in scheduled task -------------------------------------------------------------