zm-oai b93a7b1512 Repair legacy Windows sandbox bin permissions for SYSTEM (#59745) ...

## Why

Legacy `.sandbox-bin` ACLs grant `SYSTEM` Modify access without `WRITE_DAC`, preventing the provisioning service from reapplying the bin policy.

## What changed

- Grant `SYSTEM` inheritable `WRITE_DAC` access when protecting the sandbox bin so it can update permissions on the directory and its children.
- Before legacy provisioning, repair the old ACL through an authenticated owner handle when `SYSTEM` is denied access. Upgrade only the expected SYSTEM entry in a protected, allow-only ACL, reject unexpected permissions, and verify that `SYSTEM` can reopen the directory with `WRITE_DAC`.

## Testing

Extend ACL coverage to check `SYSTEM` permissions on the bin and existing and newly created runner files. Add an ignored Windows integration test requiring LocalSystem and user-owned legacy homes to cover successful repair, repeated repair, and rejection of an explicit SYSTEM deny entry.

GitOrigin-RevId: 2303cdf5182947c2d044c79ac7027a16f0373c7d

2026-11-05 21:33:57 +00:00

..

src

Repair legacy Windows sandbox bin permissions for SYSTEM (#59745)

2026-11-05 21:33:57 +00:00

BUILD.bazel

Add Bazel release staging archives (#51850)

2026-10-07 22:11:14 +00:00

Cargo.toml

Honor home deletion preferences during Windows uninstall (#54708)

2026-10-16 21:00:02 +00:00