Fix MoveDistribution VHD ownership restore to reuse the resolved file handle (backport to release/2.7)#41147
Merged
benhillis merged 1 commit intoJul 23, 2026
Conversation
… handle setVhdOwner now opens the destination impersonated with READ_CONTROL, then uses ReOpenFile to upgrade the same handle to WRITE_OWNER while running as SYSTEM, instead of re-opening the path by name as SYSTEM. This avoids a second path resolution under elevated privileges. Also moves the rollback scope_exit registration earlier so a failure in setVhdOwner while moving to the new path correctly triggers rollback.
Contributor
There was a problem hiding this comment.
Pull request overview
Backports the MoveDistribution VHD ownership-restore fix to release/2.7, ensuring ownership is restored using a handle tied to the already-resolved destination file object (avoiding re-walking the destination path as SYSTEM) and improving rollback behavior when ownership restoration fails.
Changes:
- Update VHD owner-restore logic to open the moved VHD while impersonating the caller (READ_CONTROL) and then
ReOpenFileforWRITE_OWNERunder SYSTEM +SE_RESTORE_NAME. - Register rollback earlier so failures during ownership restoration still trigger a move-back and registry correction.
- On rollback, best-effort re-apply ownership fix to the reverted VHD in case a cross-volume copy altered ownership.
OneBlue
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #41131 to release/2.7.
setVhdOwner now opens the destination impersonated as the caller with READ_CONTROL, then uses ReOpenFile to upgrade that same handle to WRITE_OWNER while running as SYSTEM with SE_RESTORE_NAME, rather than re-resolving the path by name. ReOpenFile reuses the existing file object instead of walking the path again.
Also moves the rollback scope_exit registration earlier so a failure in setVhdOwner while moving to the new path correctly triggers rollback of the move and registry changes.