Windows: every confined command dies with 0xC0000142 in workspace-write (default DACL names a capability SID the token does not carry)

[HuJiaming007]

English

Summary

On Windows 11 (build 22635.5305), with file policy set to workspace-write, every
confined command fails immediately with exit code 3221225794 (0xC0000142,
STATUS_DLL_INIT_FAILED) and no stdout/stderr. read-only works. danger-full-access
works. The bundled diagnose-windows-sandbox-acl skill does not apply: this is not a
file-permission problem (see "ACLs are exonerated" below).

Affected package: @deepseek-ai/dsh-sandbox-windows-acl@0.2.0-rc.2 (DSH desktop profile).
It is executable-independent: cmd.exe, powershell.exe (5.1) and MSIX pwsh 7.6.6 all die.

Reproduction

Two independent ways, neither depending on the caller's own confinement:

1. Invoke the shipped runner directly (production code, from app.asar):

<electron-as-node> "<install>\resources\app.asar\dsh\node_modules\@deepseek-ai\dsh-sandbox-windows-acl\lib\runner.js" \
  --workspace <workspace> --temp <temp-root> --mode workspace-write -- \
  C:\Windows\System32\cmd.exe /c "echo hello"

Result: exit -1073741502 (0xC0000142), no output.
With --mode read-only: exit 0, hello printed.

2. Parameterized bisect against AclSandbox (imported straight out of app.asar,
   run with ELECTRON_RUN_AS_NODE=1), varying only the SID that enters the token:

#	extra SID in the token	resolvable name	an enabled group of the token	result
1	S-1-5-32-545 BUILTIN\Users	yes	yes	OK
2	S-1-5-11 Authenticated Users	yes	yes	OK
3	S-1-5-21-<machine>-1011 (a local group)	yes	yes	OK
4	S-1-5-32-546 BUILTIN\Guests	yes	no	0xC0000142
5	S-1-5-21-1111111111-2222222222-3333333333-1500 (nonexistent)	no	no	0xC0000142
6	S-1-4-… capability SID (the real workspace/temp write SID)	no	no	0xC0000142
7	split: restricting list carries #4, default-DACL grant uses #1	—	—	OK
8	split: restricting list carries #1, default-DACL grant uses #4	—	—	0xC0000142

All rows use manageDacls: false (zero DACL/label edits), no TMP/TEMP rewrite,
unchanged cwd — so directory grants, integrity labels and the temp directory are
all out of scope. Rows 7/8 isolate the trigger to the token default DACL.

3. Image-load trace (NT Kernel Logger, keyword 0x7 = process|thread|img,
   tracerpt → CSV, filtered by child PID):

target	healthy child	failing child
cmd.exe	cmd → ntdll → kernel32 → KernelBase → ucrtbase → kernel.appcore → msvcrt (7)	cmd → ntdll → kernel32 → KernelBase (4, stops here)
powershell.exe 5.1	… → KernelBase → msvcrt → oleaut32 → … (95)	… → KernelBase (4, stops here)

The child always dies exactly where the first CRT DLL of its dependency chain
(ucrtbase.dll, resp. msvcrt.dll) would be initialized.

Current behavior

workspace-write: exit 3221225794 / 0xC0000142, empty output, for every executable.
read-only: works (and correctly denies writes inside the workspace, so confinement
itself is functional).

Expected behavior

workspace-write spawns the confined child, the command runs, writes outside the
workspace are denied.

Environment

• OS: Windows 11 23H2 Insider, build 22635.5305 (registry ProductName still reports
  Windows 10 Pro, the known legacy value). Note the source comment in
  dsh-sandbox-windows-acl states "verified on Win11 26200".
• Host: DeepSeek Harness (Electron 44.0.0, Node 24.18.1), profile desktop.
• pwsh: MSIX/Store build 7.6.6 (C:\Program Files\WindowsApps\Microsoft.PowerShell_7.6.6.0_x64__8wekyb3d8bbwe\pwsh.exe,
  reached through the app execution alias). Irrelevant to the failure — cmd.exe and
  5.1 fail identically.
• Caller token: high integrity, SeDebugPrivilege enabled.

Root cause

@deepseek-ai/dsh-sandbox-windows-acl/lib/types-Cl_DXjhk.js (shipped bundle):

// ~line 1293, in AclSandbox.init()
setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid);

• read-only resolves to ?? worldSid — EVERYONE, an enabled group of the child
  token — and works.
• workspace-write resolves to the capability SID (S-1-4-…, created by
  workspaceWriteSid() / tempWriteSid()), which the token does not carry as a group.

Failure chain: the ACE is merged into TokenDefaultDacl; every kernel object the child
creates without an explicit security descriptor inherits that DACL; the normal access
check (pass 1, evaluated against the token's own SIDs) can never be satisfied by a
capability SID, while the write-restricted pass 2 check only sees the restricting list.
With the two checks intersected, the child cannot write to objects it just created, so
the CRT's initialization fails, its DllMain returns FALSE, and the process dies with
STATUS_DLL_INIT_FAILED. The doc comment above the call explains the intent (letting
newly created pipes pass the pass-2 check) — but that reasoning only covers pass 2 and
misses pass 1; worldSid satisfies both, which is exactly why read-only has always
been healthy.

Suggested fix

-setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid);
+setTokenDefaultDaclGrant(api, restrictedToken, worldSid);

A/B verification of that one-line change

An app.asar copy was byte-patched with an equal-length replacement (entry offsets
preserved) and driven through the production runner in workspace-write
(including the real directory grants and the TMP/TEMP rewrite):

phase	cmd.exe	powershell.exe 5.1	MSIX pwsh 7.6.6
control (unpatched)	0xC0000142	0xC0000142	0xC0000142
patched	exit 0, output printed	exit 0, output printed	exit 0, output printed

Out of scope (already excluded)

• Not the ACL repair skill's domain: the manageDacls: false scenario reproduces with
  zero ACL/label changes. Workspace ACLs were also confirmed writable/owned correctly.
• Not PowerShell/MSIX/pwshPath: cmd.exe fails identically, so pwshPath config or an
  MSI PowerShell install changes nothing.
• Not the restricting-SID list itself: rows 7/8 above.
• No alternative Windows backend exists: dsh-sandbox-local's Windows backend is this
  runner.

---

中文

概述

Windows 11（build 22635.5305）上，文件策略为 workspace-write 时，每一条受限命令
都立刻以退出码 3221225794（0xC0000142，STATUS_DLL_INIT_FAILED）失败，且没有任何
stdout/stderr。read-only 正常，danger-full-access 正常。自带的
diagnose-windows-sandbox-acl 技能不适用：这不是文件权限问题（见下文"已排除 ACL"）。

受影响包：@deepseek-ai/dsh-sandbox-windows-acl@0.2.0-rc.2（DSH desktop profile）。
与可执行文件无关：cmd.exe、powershell.exe 5.1、MSIX pwsh 7.6.6 全部一样失败。

复现

两种方式，都不依赖调用方自身的受限状态：

1. 直接调用随包发布的 runner（生产代码，位于 app.asar 内）：

<electron-as-node> "<install>\resources\app.asar\dsh\node_modules\@deepseek-ai\dsh-sandbox-windows-acl\lib\runner.js" \
  --workspace <workspace> --temp <temp-root> --mode workspace-write -- \
  C:\Windows\System32\cmd.exe /c "echo hello"

结果：退出码 -1073741502（0xC0000142），无输出。
改成 --mode read-only：退出码 0，正常打印 hello。

2. 用 AclSandbox（直接从 app.asar import，ELECTRON_RUN_AS_NODE=1 运行）做参数化
   二分，只改变进入令牌的那一个 SID：见上表 1–8。

   全部场景使用 manageDacls: false（零 DACL/标签改动）、不重写 TMP/TEMP、cwd 不变，
   因此目录授权、完整性标签、临时目录都被排除。第 7/8 行把触发点定位到
   令牌默认 DACL。

3. 镜像加载跟踪（NT Kernel Logger，关键字 0x7，tracerpt 转 CSV 后按子进程 PID 过滤）：
   见上表。子进程总是恰好死在其依赖链里第一个 CRT DLL（ucrtbase.dll 或
   msvcrt.dll）初始化的位置。

当前行为

workspace-write：退出码 3221225794 / 0xC0000142，输出为空，任何可执行文件都一样。
read-only：正常（并且正确拒绝了工作区内的写入，说明约束本身是可用的）。

预期行为

workspace-write 能正常启动受限子进程并执行命令，工作区之外的写入被拒绝。

环境

• OS：Windows 11 23H2 预览版，build 22635.5305（注册表 ProductName 仍为
  Windows 10 Pro，属已知遗留值）。注意 dsh-sandbox-windows-acl 源码注释声明
  "verified on Win11 26200"。
• 宿主：DeepSeek Harness（Electron 44.0.0、Node 24.18.1），profile desktop。
• pwsh：Store/MSIX 版 7.6.6（经 App Execution Alias 命中）。与本次故障无关——
  cmd.exe 与 5.1 表现完全相同。
• 调用方令牌：高完整性，SeDebugPrivilege 已启用。

根因

@deepseek-ai/dsh-sandbox-windows-acl/lib/types-Cl_DXjhk.js（随包发布版本，约 1293 行，
AclSandbox.init() 内）：

setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid);

• read-only 取到 ?? worldSid —— EVERYONE，是子令牌自身携带的启用组 —— 因此正常。
• workspace-write 取到能力 SID（S-1-4-…，由 workspaceWriteSid() /
  tempWriteSid() 派生），而令牌并不把它作为组携带。

失败链条：该 ACE 被并入 TokenDefaultDacl；子进程创建的、未显式指定安全描述符的内核对象
都会继承这个默认 DACL；普通检查（pass 1，用令牌自身的 SID 判定）永远无法被能力 SID 满足，
而 write-restricted 的 pass 2 检查只看 restricting 列表。两次检查取交集后，子进程
无法写入自己刚创建的对象，于是 CRT 初始化失败、DllMain 返回 FALSE，进程以
STATUS_DLL_INIT_FAILED 死亡。该调用上方的注释说明了动机（让新建管道通过 pass-2 检查），
但那份推理只覆盖了 pass 2，漏掉了 pass 1；worldSid 能同时满足两次检查——这正是
read-only 一直健康的原因。

建议修复

-setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid);
+setTokenDefaultDaclGrant(api, restrictedToken, worldSid);

该一行改动的 A/B 验证

把 app.asar 复制一份并做等长字节替换（保持 asar 条目偏移不变），再用
生产同款 runner 在 workspace-write 下运行（含真实目录授权与 TMP/TEMP 重写）：

阶段	cmd.exe	powershell.exe 5.1	MSIX pwsh 7.6.6
对照（未打补丁）	0xC0000142	0xC0000142	0xC0000142
打补丁	退出码 0，正常输出	退出码 0，正常输出	退出码 0，正常输出

已排除项

• 不属于 ACL 修复技能的范畴：manageDacls: false 场景在零 ACL/标签改动下即可复现；
  工作区 ACL 的所有权与可写性也已确认正常。
• 不是 PowerShell / MSIX / pwshPath 的问题：cmd.exe 表现完全相同，所以改
  pwshPath 或装 MSI 版 PowerShell 都不起作用。
• 不是 restricting SID 列表本身的问题：见上表第 7/8 行。
• 不存在可切换的 Windows 替代后端：dsh-sandbox-local 的 Windows 后端就是这个 runner。

[HuJiaming007]

Source-level patch and verification (attaching here because PRs are closed)

CONTRIBUTING.md states external pull requests are not accepted at the moment, and the
repository reports has_pull_requests: false, so instead of opening a PR I am attaching
the source-level patch here for the report above. It applies cleanly to master
(git apply --check exit 0).

Two candidate one-line fixes, both verified against the shipped runner

Method: byte-patch a copy of app.asar (equal-length replacement, so asar entry offsets
stay valid) and drive it through the production runner
@deepseek-ai/dsh-sandbox-windows-acl/lib/runner.js with --mode workspace-write, i.e.
including the real directory grants and the TMP/TEMP rewrite — the same code path as the
report.

value passed to setTokenDefaultDaclGrant	cmd.exe	powershell.exe 5.1	MSIX pwsh 7.6.6
this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid (current)	0xC0000142	0xC0000142	0xC0000142
worldSid (what read-only already resolves to)	exit 0, output	exit 0, output	exit 0, output
logonSid (recommended)	exit 0, output	exit 0, output	exit 0, output

Why logonSid rather than worldSid

The merged default-DACL ACE has to satisfy both access checks for objects the confined
process creates:

• pass 1 — evaluated against the token's own enabled SIDs;
• pass 2 — the WRITE_RESTRICTED check, evaluated against the restricting list.

A capability SID only satisfies pass 2, so the ACE grants nothing in the intersection and
the confined process cannot write an object it just created: it dies during early CRT
initialization. The logon SID is the one SID satisfying both — it is an enabled group of
the token (pass 1) and the restricting list already carries it in either mode (pass 2).
Being session-scoped it is narrower than Everyone, and it never propagates the shared
workspace/temp capability into default-DACL objects, which preserves the intent of the
existing comment at src/index.ts:292.

worldSid also works and is what read-only effectively uses today, but it is the broader
grant of the two.

Patch

diff --git a/packages/sandbox/sandbox-windows-acl/src/index.ts b/packages/sandbox/sandbox-windows-acl/src/index.ts
index 5de5d47..4fc7746 100644
--- a/packages/sandbox/sandbox-windows-acl/src/index.ts
+++ b/packages/sandbox/sandbox-windows-acl/src/index.ts
@@ -290,18 +290,21 @@ export class AclSandbox {
       restrictTokenIntegrity(api, restrictedToken, lowLabelSid)
       this.token = restrictedToken
       // The restricted token's default DACL still names only the user's
-      // ambient SIDs — none of the restricting SIDs. Every NEW object the
+      // ambient SIDs — none of the capability SIDs. Every NEW object the
       // confined process creates (anonymous stdio pipes, sync objects) takes
-      // its DACL from that default, so the write pass-2 check would deny
-      // pipe creation (ERROR_ACCESS_DENIED; Node EPERM) and break every
-      // piped-stdio grandchild spawn. Merge a full-access ACE for a
-      // restricting SID (the PRIVATE temp SID when present, otherwise the
-      // workspace SID, or Everyone under read-only): new-object creation
-      // stays gated by the parent object's DACL, while the new object's own
-      // DACL passes pass-2. Choosing the temp SID prevents default-DACL
-      // objects in one session's temp tree from acquiring the shared
-      // workspace capability.
-      setTokenDefaultDaclGrant(api, restrictedToken, this.tempWriteSidPtr ?? this.writeSidPtr ?? worldSid)
+      // its DACL from that default, and such an object must pass BOTH access
+      // checks: pass 1 against the token's own enabled SIDs, and pass 2
+      // (WRITE_RESTRICTED) against the restricting list. An ACE naming a
+      // capability SID satisfies pass 2 only, so the confined process cannot
+      // write an object it just created and dies during early CRT
+      // initialization (STATUS_DLL_INIT_FAILED / 0xC0000142; reproduced on
+      // Win11 22635 with cmd.exe, powershell.exe and pwsh). The logon SID is
+      // the SID that satisfies both: an enabled group of the token (pass 1)
+      // that the restricting list already carries in either mode (pass 2).
+      // Session-scoped, it is also narrower than Everyone — which is what
+      // read-only effectively uses — and it never propagates the shared
+      // workspace or temp capability into default-DACL objects.
+      setTokenDefaultDaclGrant(api, restrictedToken, logonSid)
       if (api.closeHandle(currentToken) === 0) throwLastError(api, 'CloseHandle', 'current process token')
       currentTokenOpen = false
       this.api = api
diff --git a/packages/sandbox/sandbox-windows-acl/src/token.ts b/packages/sandbox/sandbox-windows-acl/src/token.ts
index d78bac0..79f9afe 100644
--- a/packages/sandbox/sandbox-windows-acl/src/token.ts
+++ b/packages/sandbox/sandbox-windows-acl/src/token.ts
@@ -100,11 +100,15 @@ export function makeWellKnownSid(api: Win32Bindings, type: number): NativePtr {
  * default DACL verbatim, which names no restricting SID: a new anonymous pipe
  * (child stdio) therefore fails the write pass-2 check at creation
  * (ERROR_ACCESS_DENIED; Node surfaces it as spawn EPERM), breaking every
- * piped-stdio grandchild spawn. The merged ACE names a RESTRICTING SID (the
- * write SID under workspace-write, Everyone under read-only), so each new
- * object's own DACL passes pass-2 while object creation itself stays gated by
- * the parent container's DACL (files outside the granted trees remain
- * uncreatable). Fails closed: any Win32 failure throws before the spawn.
+ * piped-stdio grandchild spawn. The merged ACE must name a SID that passes
+ * BOTH checks: an enabled group of the token itself (pass 1) and a member of
+ * the restricting list (pass 2). A capability SID satisfies pass 2 alone, and
+ * the confined process then cannot write the objects it creates — it dies in
+ * early CRT initialization with STATUS_DLL_INIT_FAILED. The logon SID is the
+ * SID that satisfies both, so each new object's own DACL passes pass-2 while
+ * object creation itself stays gated by the parent container's DACL (files
+ * outside the granted trees remain uncreatable). Fails closed: any Win32
+ * failure throws before the spawn.
  * @param api - the binding table.
  * @param token - the restricted token to adjust (requires TOKEN_ADJUST_DEFAULT).
  * @param sidPtr - the restricting SID whose full-access ACE joins the default DACL.

token.ts changes are documentation only; the shipped app.asar bundle needs the usual
rebuild.

Caveats

• Verified by byte-patching the shipped bundle (identical code path), not by compiling
  this diff — the patch itself has only been git apply-checked.
• A regression test that would have caught this: in the restrict-variant verification
  harness, spawn any child under workspace-write and assert the exit code is not
  0xC0000142.