Repository: aws-deadline/deadline-cloud-worker-agent
Pull request #609: feat(HOST_CONFIGURATION_FEATURE): Prevent Windows ACL inheritance for host config script and log and grant full control to Administrators
Author: login: leongdl
Created: 2025-04-27T03:42:03Z | Merged: 2025-04-30T22:27:56Z

### What was the problem/requirement? (What/Why)
- From my Prior PR, we had an open comment to improve the security stance of the logging and host config script.
- After deep diving, I found the files had inherited access. 
- Also Current User + Admin had a looser file access permission bits.
- The previous implementation also checked for User access as a subset of permission bits.

### What was the solution? (How)
- Disable File inheritance - See https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-control, SE_DACL_PROTECTED
- Explicit permission set for current user (worker agent), and Administrators
- Explicit check users group is not allowed
- Explicit check no other DACL SIDs exists (eg other users or groups)

### Addendum
- Also updated openjd-sessions to `0.10.2` to incorporate latest version.

### What is the impact of this change?
- The files involved with Host Configuration are fully locked down.

### How was this change tested?
- hatch build
- hatch run fmt
- hatch run lint
- hatch run test
- hatch run integ-test
- hatch run e2e-test (windows, Host Config test not published yet.)

### Was this change documented?
- No.

### Is this a breaking change?
- No.

----

*By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.*


Diff:
diff --git a/pyproject.toml b/pyproject.toml
index 90f11965..c0cb61f0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -15,7 +15,7 @@ dependencies = [
     "boto3 >= 1.34.75",
     "deadline == 0.49.*",
     # Pinned to patch version due to Host Config Script runner usage of private OpenJD Sessions API.
-    "openjd-sessions == 0.10.1",
+    "openjd-sessions == 0.10.2",
     # tomli became tomllib in standard library in Python 3.11
     "tomli == 2.0.* ; python_version<'3.11'",
     "tomlkit == 0.13.*",
diff --git a/src/deadline_worker_agent/file_system_operations.py b/src/deadline_worker_agent/file_system_operations.py
index 489bcd2e..1e046317 100644
--- a/src/deadline_worker_agent/file_system_operations.py
+++ b/src/deadline_worker_agent/file_system_operations.py
@@ -40,6 +40,9 @@ def touch_file(
     user_permission: Optional[FileSystemPermissionEnum] = None,
     permitted_user: Optional[SessionUser] = None,
     agent_user_permission: Optional[FileSystemPermissionEnum] = None,
+    group: Optional[str] = None,
+    group_permission: Optional[FileSystemPermissionEnum] = None,
+    disable_permission_inheritance: bool = False,
 ):
     if os.name == "nt":
         permitted_user = cast(WindowsSessionUser, permitted_user)
@@ -52,6 +55,9 @@ def touch_file(
             user=permitted_user.user if permitted_user else None,
             user_permission=user_permission,
             agent_user_permission=agent_user_permission,
+            group=group,
+            group_permission=group_permission,
+            disable_permission_inheritance=disable_permission_inheritance,
         )
 
 
@@ -84,6 +90,7 @@ def _set_windows_permissions(
     group_permission: Optional[FileSystemPermissionEnum] = None,
     agent_user_permission: Optional[FileSystemPermissionEnum] = None,
     users_group_permission: Optional[FileSystemPermissionEnum] = None,
+    disable_permission_inheritance: bool = False,
 ):
     import win32security
     import ntsecuritycon
@@ -144,6 +151,12 @@ def _set_windows_permissions(
     # Get the security descriptor of the object
     sd = win32security.GetFileSecurity(str(path.resolve()), win32security.DACL_SECURITY_INFORMATION)
 
+    # Disable inheritance and convert inherited ACEs to explicit ACEs
+    if disable_permission_inheritance:
+        sd.SetSecurityDescriptorControl(
+            win32security.SE_DACL_PROTECTED, win32security.SE_DACL_PROTECTED
+        )
+
     # Set the security descriptor's DACL to the newly-created DACL
     # Arguments:
     # 1. bDaclPresent = 1: Indicates that the DACL is present in the security descriptor.
diff --git a/src/deadline_worker_agent/windows/win_admin_runner.py b/src/deadline_worker_agent/windows/win_admin_runner.py
index 99b39afa..bf3a22fe 100644
--- a/src/deadline_worker_agent/windows/win_admin_runner.py
+++ b/src/deadline_worker_agent/windows/win_admin_runner.py
@@ -124,8 +124,14 @@ def _prepare_file_permissions(self):
         touch_file(
             file_path=Path(self._logfile),
             agent_user_permission=FileSystemPermissionEnum.FULL_CONTROL,
+            group="Administrators",
+            group_permission=FileSystemPermissionEnum.FULL_CONTROL,
+            disable_permission_inheritance=True,
         )
         touch_file(
             file_path=Path(self._script_path),
             agent_user_permission=FileSystemPermissionEnum.FULL_CONTROL,
+            group="Administrators",
+            group_permission=FileSystemPermissionEnum.FULL_CONTROL,
+            disable_permission_inheritance=True,
         )
diff --git a/test/integ/startup/test_host_configuration.py b/test/integ/startup/test_host_configuration.py
index 85565a45..646abb50 100644
--- a/test/integ/startup/test_host_configuration.py
+++ b/test/integ/startup/test_host_configuration.py
@@ -335,41 +335,82 @@ def _windows_file_permissions_test(file_path: str) -> None:
     import win32security
     import ntsecuritycon
 
-    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    # Get relevant SIDs
     current_user_sid, _, _ = win32security.LookupAccountName(None, getpass.getuser())
+    administrators_sid, _, _ = win32security.LookupAccountName(None, "Administrators")
+    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+
+    # Get security descriptor
     sd = win32security.GetFileSecurity(
         str(file_path),
         win32con.DACL_SECURITY_INFORMATION | win32con.OWNER_SECURITY_INFORMATION,
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
-        assert False, "All users have access to the file."
+        assert False, "No DACL found - all users have access to the file."
 
-    # Iterate through each ACE in the DACL
+    # Track permissions for allowed entities
+    current_user_permissions = 0
+    admin_permissions = 0
+    other_sids_found = []
+
+    # Explicit check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
 
+        assert ace_type == ntsecuritycon.ACCESS_ALLOWED_ACE_TYPE, (
+            f"Unexpected ace type found for sid {sid}"
+        )
+
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, (
+                f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+            )
+
+        if sid == current_user_sid:
+            current_user_permissions |= ace_mask
+        elif sid == administrators_sid:
+            admin_permissions |= ace_mask
+        else:  # We already checked Users group
+            # Keep track of any other SIDs that have access
+            other_sids_found.append((win32security.LookupAccountSid(None, sid)[0], ace_mask))
+
+    # Check that no other SIDs have access
+    assert not other_sids_found, f"Found unexpected SIDs with access: {other_sids_found}"
+
+    # Define required permissions for current user and admin.
+    # This is the scoped down set from checking the underlying application.
+    required_permissions = (
+        ntsecuritycon.FILE_READ_DATA  # 0x1
+        | ntsecuritycon.FILE_WRITE_DATA  # 0x2
+        | ntsecuritycon.FILE_APPEND_DATA  # 0x4
+        | ntsecuritycon.FILE_READ_EA  # 0x8
+        | ntsecuritycon.FILE_WRITE_EA  # 0x10
+        | ntsecuritycon.FILE_EXECUTE  # 0x20
+        | ntsecuritycon.FILE_DELETE_CHILD  # 0x40
+        | ntsecuritycon.FILE_READ_ATTRIBUTES  # 0x80
+        | ntsecuritycon.FILE_WRITE_ATTRIBUTES  # 0x100
+        | ntsecuritycon.DELETE  # 0x10000
+        | ntsecuritycon.READ_CONTROL  # 0x20000
+        | ntsecuritycon.WRITE_DAC  # 0x40000
+        | ntsecuritycon.WRITE_OWNER  # 0x80000
+        | ntsecuritycon.SYNCHRONIZE  # 0x100000
+    )
+
+    # Check current user permissions
+    assert current_user_permissions == required_permissions, (
+        f"Current user does not have correct permissions. Has: {current_user_permissions}, "
+        f"Needs: {required_permissions}"
+    )
+
+    # Check Administrator group has required permissions.
+    assert admin_permissions == required_permissions, (
+        f"Administrator does not have correct permissions. Has: {current_user_permissions}, "
+        f"Needs: {required_permissions}"
+    )
+
+    # Check that inheritance is disabled
+    control = sd.GetSecurityDescriptorControl()
+    assert control[0] & win32security.SE_DACL_PROTECTED, "DACL should be protected from inheritance"


Reviews:
user: login: github-advanced-security[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-29T17:52:43Z
user: login: github-advanced-security[bot]
state: COMMENTED
author_association: NONE
submitted_at: 2025-04-29T21:21:25Z
user: login: jusiskin
state: CHANGES_REQUESTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T22:46:29Z
user: login: leongdl
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T23:12:11Z
user: login: leongdl
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T23:13:23Z
user: login: leongdl
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T23:15:31Z
user: login: leongdl
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T23:22:29Z
user: login: leongdl
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T00:41:22Z
user: login: leongdl
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T00:41:37Z
user: login: AWS-Samuel
state: CHANGES_REQUESTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T14:38:26Z
user: login: leongdl
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T18:35:12Z
user: login: AWS-Samuel
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T20:52:02Z
user: login: AWS-Samuel
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T20:52:11Z
user: login: leongdl
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T22:03:39Z
user: login: leongdl
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T22:04:09Z
user: login: leongdl
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T22:04:35Z
user: login: AWS-Samuel
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T22:15:44Z
user: login: jusiskin
body: Thanks for your patience and cooperation during this code review. This improves the security of this feature and adds important automated security regression test coverage.
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T22:22:28Z

Review comments:
diff_hunk: @@ -343,33 +343,43 @@
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
         assert False, "All users have access to the file."
 
-    # Iterate through each ACE in the DACL
+    # Check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
-
+        
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+    
+    # Check that current user has the necessary permissions
+    current_user_permissions = 0
+    for i in range(dacl.GetAceCount()):
+        ace = dacl.GetAce(i)
+        (ace_type, ace_flags), ace_mask, sid = ace
path: test/integ/startup/test_host_configuration.py
user: login: github-advanced-security[bot]
body: ## Unused local variable

Variable ace_type is not used.

[Show more details](https://github.com/aws-deadline/deadline-cloud-worker-agent/security/code-scanning/182)
created_at: 2025-04-29T17:52:43Z
author_association: NONE
diff_hunk: @@ -343,33 +343,43 @@
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
         assert False, "All users have access to the file."
 
-    # Iterate through each ACE in the DACL
+    # Check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
-
+        
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+    
+    # Check that current user has the necessary permissions
+    current_user_permissions = 0
+    for i in range(dacl.GetAceCount()):
+        ace = dacl.GetAce(i)
+        (ace_type, ace_flags), ace_mask, sid = ace
path: test/integ/startup/test_host_configuration.py
user: login: github-advanced-security[bot]
body: ## Unused local variable

Variable ace_flags is not used.

[Show more details](https://github.com/aws-deadline/deadline-cloud-worker-agent/security/code-scanning/183)
created_at: 2025-04-29T17:52:43Z
author_association: NONE
diff_hunk: @@ -335,41 +335,80 @@
     import win32security
     import ntsecuritycon
 
-    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    # Get relevant SIDs
     current_user_sid, _, _ = win32security.LookupAccountName(None, getpass.getuser())
+    administrators_sid, _, _ = win32security.LookupAccountName(None, "Administrators")
+    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    
+    # Get security descriptor
     sd = win32security.GetFileSecurity(
         str(file_path),
         win32con.DACL_SECURITY_INFORMATION | win32con.OWNER_SECURITY_INFORMATION,
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
-        assert False, "All users have access to the file."
+        assert False, "No DACL found - all users have access to the file."
 
-    # Iterate through each ACE in the DACL
+    # Track permissions for allowed entities
+    current_user_permissions = 0
+    admin_permissions = 0
+    other_sids_found = []
+
+    # Explicit check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
 
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, (
+                f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+            )
+
+        if sid == current_user_sid:
+            current_user_permissions |= ace_mask
+        elif sid == administrators_sid:
+            admin_permissions |= ace_mask
+        elif sid != users_group_sid:  # We already checked Users group
path: test/integ/startup/test_host_configuration.py
user: login: github-advanced-security[bot]
body: ## Redundant comparison

Test is always true, because of [this condition](1).

[Show more details](https://github.com/aws-deadline/deadline-cloud-worker-agent/security/code-scanning/184)
created_at: 2025-04-29T21:21:25Z
author_association: NONE
diff_hunk: @@ -335,41 +335,74 @@ def _windows_file_permissions_test(file_path: str) -> None:
     import win32security
     import ntsecuritycon
 
-    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    # Get relevant SIDs
     current_user_sid, _, _ = win32security.LookupAccountName(None, getpass.getuser())
+    administrators_sid, _, _ = win32security.LookupAccountName(None, "Administrators")
+    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+
+    # Get security descriptor
     sd = win32security.GetFileSecurity(
         str(file_path),
         win32con.DACL_SECURITY_INFORMATION | win32con.OWNER_SECURITY_INFORMATION,
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
-        assert False, "All users have access to the file."
+        assert False, "No DACL found - all users have access to the file."
 
-    # Iterate through each ACE in the DACL
+    # Track permissions for allowed entities
+    current_user_permissions = 0
+    admin_permissions = 0
+    other_sids_found = []
+
+    # Explicit check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
 
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, (
+                f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+            )
+
+        if sid == current_user_sid:
+            current_user_permissions |= ace_mask
+        elif sid == administrators_sid:
+            admin_permissions |= ace_mask
+        else:  # We already checked Users group
+            # Keep track of any other SIDs that have access
+            other_sids_found.append((win32security.LookupAccountSid(None, sid)[0], ace_mask))
+
+    # Check that no other SIDs have access
+    assert not other_sids_found, f"Found unexpected SIDs with access: {other_sids_found}"
+
+    # Define required permissions for current user
+    required_permissions = (
+        ntsecuritycon.FILE_READ_DATA
+        | ntsecuritycon.FILE_READ_ATTRIBUTES
+        | ntsecuritycon.FILE_WRITE_DATA
+        | ntsecuritycon.FILE_APPEND_DATA
+        | ntsecuritycon.FILE_WRITE_ATTRIBUTES
+    )
+
+    # Check current user permissions
+    assert (current_user_permissions & required_permissions) == required_permissions, (
+        f"Current user missing required permissions. Has: {current_user_permissions}, "
+        f"Needs: {required_permissions}"
+    )
+
+    # Check basic read/write for current user
+    has_read = (current_user_permissions & ntsecuritycon.FILE_GENERIC_READ) != 0
+    has_write = (current_user_permissions & ntsecuritycon.FILE_GENERIC_WRITE) != 0
path: test/integ/startup/test_host_configuration.py
user: login: jusiskin
body: Is this redundant based on lines 380-392?
created_at: 2025-04-29T22:40:45Z
author_association: CONTRIBUTOR
diff_hunk: @@ -335,41 +335,74 @@ def _windows_file_permissions_test(file_path: str) -> None:
     import win32security
     import ntsecuritycon
 
-    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    # Get relevant SIDs
     current_user_sid, _, _ = win32security.LookupAccountName(None, getpass.getuser())
+    administrators_sid, _, _ = win32security.LookupAccountName(None, "Administrators")
+    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+
+    # Get security descriptor
     sd = win32security.GetFileSecurity(
         str(file_path),
         win32con.DACL_SECURITY_INFORMATION | win32con.OWNER_SECURITY_INFORMATION,
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
-        assert False, "All users have access to the file."
+        assert False, "No DACL found - all users have access to the file."
 
-    # Iterate through each ACE in the DACL
+    # Track permissions for allowed entities
+    current_user_permissions = 0
+    admin_permissions = 0
+    other_sids_found = []
+
+    # Explicit check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
 
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, (
+                f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+            )
+
+        if sid == current_user_sid:
+            current_user_permissions |= ace_mask
+        elif sid == administrators_sid:
+            admin_permissions |= ace_mask
+        else:  # We already checked Users group
+            # Keep track of any other SIDs that have access
+            other_sids_found.append((win32security.LookupAccountSid(None, sid)[0], ace_mask))
+
+    # Check that no other SIDs have access
+    assert not other_sids_found, f"Found unexpected SIDs with access: {other_sids_found}"
+
+    # Define required permissions for current user
+    required_permissions = (
+        ntsecuritycon.FILE_READ_DATA
+        | ntsecuritycon.FILE_READ_ATTRIBUTES
+        | ntsecuritycon.FILE_WRITE_DATA
+        | ntsecuritycon.FILE_APPEND_DATA
+        | ntsecuritycon.FILE_WRITE_ATTRIBUTES
+    )
+
+    # Check current user permissions
+    assert (current_user_permissions & required_permissions) == required_permissions, (
+        f"Current user missing required permissions. Has: {current_user_permissions}, "
+        f"Needs: {required_permissions}"
+    )
+
+    # Check basic read/write for current user
+    has_read = (current_user_permissions & ntsecuritycon.FILE_GENERIC_READ) != 0
+    has_write = (current_user_permissions & ntsecuritycon.FILE_GENERIC_WRITE) != 0
+
+    assert has_read, "Current user should have read permissions"
+    assert has_write, "Current user should have write permissions"
+
+    # Check Administrator group has required permissions
+    assert (admin_permissions & required_permissions) != 0, (
+        "Administrators group should have required permissions"
+    )
path: test/integ/startup/test_host_configuration.py
user: login: jusiskin
body: This is just checking for overlap with the required permissions? Is that what we want?
created_at: 2025-04-29T22:41:07Z
author_association: CONTRIBUTOR
diff_hunk: @@ -335,41 +335,74 @@ def _windows_file_permissions_test(file_path: str) -> None:
     import win32security
     import ntsecuritycon
 
-    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    # Get relevant SIDs
     current_user_sid, _, _ = win32security.LookupAccountName(None, getpass.getuser())
+    administrators_sid, _, _ = win32security.LookupAccountName(None, "Administrators")
+    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+
+    # Get security descriptor
     sd = win32security.GetFileSecurity(
         str(file_path),
         win32con.DACL_SECURITY_INFORMATION | win32con.OWNER_SECURITY_INFORMATION,
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
-        assert False, "All users have access to the file."
+        assert False, "No DACL found - all users have access to the file."
 
-    # Iterate through each ACE in the DACL
+    # Track permissions for allowed entities
+    current_user_permissions = 0
+    admin_permissions = 0
+    other_sids_found = []
+
+    # Explicit check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
 
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, (
+                f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+            )
+
+        if sid == current_user_sid:
+            current_user_permissions |= ace_mask
+        elif sid == administrators_sid:
+            admin_permissions |= ace_mask
+        else:  # We already checked Users group
+            # Keep track of any other SIDs that have access
+            other_sids_found.append((win32security.LookupAccountSid(None, sid)[0], ace_mask))
+
+    # Check that no other SIDs have access
+    assert not other_sids_found, f"Found unexpected SIDs with access: {other_sids_found}"
+
+    # Define required permissions for current user
+    required_permissions = (
+        ntsecuritycon.FILE_READ_DATA
+        | ntsecuritycon.FILE_READ_ATTRIBUTES
+        | ntsecuritycon.FILE_WRITE_DATA
+        | ntsecuritycon.FILE_APPEND_DATA
+        | ntsecuritycon.FILE_WRITE_ATTRIBUTES
+    )
path: test/integ/startup/test_host_configuration.py
user: login: jusiskin
body: Looking at the functional changes above, we are granting full control. This is only looking at file access permissions. Should we expand the set of expected permissions?
created_at: 2025-04-29T22:42:15Z
author_association: CONTRIBUTOR
diff_hunk: @@ -144,6 +151,12 @@ def _set_windows_permissions(
     # Get the security descriptor of the object
     sd = win32security.GetFileSecurity(str(path.resolve()), win32security.DACL_SECURITY_INFORMATION)
 
+    # Disable inheritance and convert inherited ACEs to explicit ACEs
+    if disable_permission_inheritance:
+        sd.SetSecurityDescriptorControl(
+            win32security.SE_DACL_PROTECTED, win32security.SE_DACL_PROTECTED
path: src/deadline_worker_agent/file_system_operations.py
user: login: jusiskin
body: The [documentation](https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-control) I found for this constant says:

>   Prevents the DACL of the security descriptor from being modified by inheritable ACEs.

Is this controlling whether the DACL will inherit ACEs from parent objects in the file-system? Or whether the security descriptor itself can be modified based on ACE inheritance (e.g. parent dir has full control and allows changing this DACL).
created_at: 2025-04-29T22:44:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -144,6 +151,12 @@ def _set_windows_permissions(
     # Get the security descriptor of the object
     sd = win32security.GetFileSecurity(str(path.resolve()), win32security.DACL_SECURITY_INFORMATION)
 
+    # Disable inheritance and convert inherited ACEs to explicit ACEs
+    if disable_permission_inheritance:
+        sd.SetSecurityDescriptorControl(
+            win32security.SE_DACL_PROTECTED, win32security.SE_DACL_PROTECTED
path: src/deadline_worker_agent/file_system_operations.py
user: login: leongdl
body: I believe we are "setting" the file security descriptor from 152 to NOT inherit from the parent. So the former.

To be clear `This ensures that only the permissions explicitly set in your code will apply to the object, and no permissions will be inherited from parent directories.`

But I think this integ test proves itself correct though. 
1. We explicitly check users is not added. 
2. Current user SID is present with the right bits.
3. Administrator group SID is present with the right bits.
4. No other SIDs are detected. 

Based on this, there permissions on the file are "exactly" what we want, otherwise the test will fail.
created_at: 2025-04-29T23:12:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -335,41 +335,74 @@ def _windows_file_permissions_test(file_path: str) -> None:
     import win32security
     import ntsecuritycon
 
-    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    # Get relevant SIDs
     current_user_sid, _, _ = win32security.LookupAccountName(None, getpass.getuser())
+    administrators_sid, _, _ = win32security.LookupAccountName(None, "Administrators")
+    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+
+    # Get security descriptor
     sd = win32security.GetFileSecurity(
         str(file_path),
         win32con.DACL_SECURITY_INFORMATION | win32con.OWNER_SECURITY_INFORMATION,
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
-        assert False, "All users have access to the file."
+        assert False, "No DACL found - all users have access to the file."
 
-    # Iterate through each ACE in the DACL
+    # Track permissions for allowed entities
+    current_user_permissions = 0
+    admin_permissions = 0
+    other_sids_found = []
+
+    # Explicit check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
 
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, (
+                f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+            )
+
+        if sid == current_user_sid:
+            current_user_permissions |= ace_mask
+        elif sid == administrators_sid:
+            admin_permissions |= ace_mask
+        else:  # We already checked Users group
+            # Keep track of any other SIDs that have access
+            other_sids_found.append((win32security.LookupAccountSid(None, sid)[0], ace_mask))
+
+    # Check that no other SIDs have access
+    assert not other_sids_found, f"Found unexpected SIDs with access: {other_sids_found}"
+
+    # Define required permissions for current user
+    required_permissions = (
+        ntsecuritycon.FILE_READ_DATA
+        | ntsecuritycon.FILE_READ_ATTRIBUTES
+        | ntsecuritycon.FILE_WRITE_DATA
+        | ntsecuritycon.FILE_APPEND_DATA
+        | ntsecuritycon.FILE_WRITE_ATTRIBUTES
+    )
+
+    # Check current user permissions
+    assert (current_user_permissions & required_permissions) == required_permissions, (
+        f"Current user missing required permissions. Has: {current_user_permissions}, "
+        f"Needs: {required_permissions}"
+    )
+
+    # Check basic read/write for current user
+    has_read = (current_user_permissions & ntsecuritycon.FILE_GENERIC_READ) != 0
+    has_write = (current_user_permissions & ntsecuritycon.FILE_GENERIC_WRITE) != 0
path: test/integ/startup/test_host_configuration.py
user: login: leongdl
body: Yeah true, left over from prior implementation when we had more generic checking. I was only thinking if `FILE_GENERIC_READ` had any superset that I may have missed in the `required_permissions` bitset.

Deleted 395 to 399 since they are redundent.
created_at: 2025-04-29T23:13:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -335,41 +335,74 @@ def _windows_file_permissions_test(file_path: str) -> None:
     import win32security
     import ntsecuritycon
 
-    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    # Get relevant SIDs
     current_user_sid, _, _ = win32security.LookupAccountName(None, getpass.getuser())
+    administrators_sid, _, _ = win32security.LookupAccountName(None, "Administrators")
+    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+
+    # Get security descriptor
     sd = win32security.GetFileSecurity(
         str(file_path),
         win32con.DACL_SECURITY_INFORMATION | win32con.OWNER_SECURITY_INFORMATION,
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
-        assert False, "All users have access to the file."
+        assert False, "No DACL found - all users have access to the file."
 
-    # Iterate through each ACE in the DACL
+    # Track permissions for allowed entities
+    current_user_permissions = 0
+    admin_permissions = 0
+    other_sids_found = []
+
+    # Explicit check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
 
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, (
+                f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+            )
+
+        if sid == current_user_sid:
+            current_user_permissions |= ace_mask
+        elif sid == administrators_sid:
+            admin_permissions |= ace_mask
+        else:  # We already checked Users group
+            # Keep track of any other SIDs that have access
+            other_sids_found.append((win32security.LookupAccountSid(None, sid)[0], ace_mask))
+
+    # Check that no other SIDs have access
+    assert not other_sids_found, f"Found unexpected SIDs with access: {other_sids_found}"
+
+    # Define required permissions for current user
+    required_permissions = (
+        ntsecuritycon.FILE_READ_DATA
+        | ntsecuritycon.FILE_READ_ATTRIBUTES
+        | ntsecuritycon.FILE_WRITE_DATA
+        | ntsecuritycon.FILE_APPEND_DATA
+        | ntsecuritycon.FILE_WRITE_ATTRIBUTES
+    )
+
+    # Check current user permissions
+    assert (current_user_permissions & required_permissions) == required_permissions, (
+        f"Current user missing required permissions. Has: {current_user_permissions}, "
+        f"Needs: {required_permissions}"
+    )
+
+    # Check basic read/write for current user
+    has_read = (current_user_permissions & ntsecuritycon.FILE_GENERIC_READ) != 0
+    has_write = (current_user_permissions & ntsecuritycon.FILE_GENERIC_WRITE) != 0
+
+    assert has_read, "Current user should have read permissions"
+    assert has_write, "Current user should have write permissions"
+
+    # Check Administrator group has required permissions
+    assert (admin_permissions & required_permissions) != 0, (
+        "Administrators group should have required permissions"
+    )
path: test/integ/startup/test_host_configuration.py
user: login: leongdl
body: For host configs yes - Administrators have sufficient access to read, write, use the file. 

However, since we gave it the input `FileSystemPermissionEnum.FULL_CONTROL.value: ntsecuritycon.GENERIC_ALL`, we can directly match to `ntsecuritycon.GENERIC_ALL`.

See comment above.
created_at: 2025-04-29T23:15:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -335,41 +335,74 @@ def _windows_file_permissions_test(file_path: str) -> None:
     import win32security
     import ntsecuritycon
 
-    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    # Get relevant SIDs
     current_user_sid, _, _ = win32security.LookupAccountName(None, getpass.getuser())
+    administrators_sid, _, _ = win32security.LookupAccountName(None, "Administrators")
+    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+
+    # Get security descriptor
     sd = win32security.GetFileSecurity(
         str(file_path),
         win32con.DACL_SECURITY_INFORMATION | win32con.OWNER_SECURITY_INFORMATION,
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
-        assert False, "All users have access to the file."
+        assert False, "No DACL found - all users have access to the file."
 
-    # Iterate through each ACE in the DACL
+    # Track permissions for allowed entities
+    current_user_permissions = 0
+    admin_permissions = 0
+    other_sids_found = []
+
+    # Explicit check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
 
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, (
+                f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+            )
+
+        if sid == current_user_sid:
+            current_user_permissions |= ace_mask
+        elif sid == administrators_sid:
+            admin_permissions |= ace_mask
+        else:  # We already checked Users group
+            # Keep track of any other SIDs that have access
+            other_sids_found.append((win32security.LookupAccountSid(None, sid)[0], ace_mask))
+
+    # Check that no other SIDs have access
+    assert not other_sids_found, f"Found unexpected SIDs with access: {other_sids_found}"
+
+    # Define required permissions for current user
+    required_permissions = (
+        ntsecuritycon.FILE_READ_DATA
+        | ntsecuritycon.FILE_READ_ATTRIBUTES
+        | ntsecuritycon.FILE_WRITE_DATA
+        | ntsecuritycon.FILE_APPEND_DATA
+        | ntsecuritycon.FILE_WRITE_ATTRIBUTES
+    )
path: test/integ/startup/test_host_configuration.py
user: login: leongdl
body: I prefer not to - this is the minimal set to "use the file" as a worker agent. 

`ntsecuritycon.GENERIC_ALL` is also checked in the `Administrators` Group, so technically the worker agent has the full set.
created_at: 2025-04-29T23:22:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -335,41 +335,76 @@ def _windows_file_permissions_test(file_path: str) -> None:
     import win32security
     import ntsecuritycon
 
-    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    # Get relevant SIDs
     current_user_sid, _, _ = win32security.LookupAccountName(None, getpass.getuser())
+    administrators_sid, _, _ = win32security.LookupAccountName(None, "Administrators")
+    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+
+    # Get security descriptor
     sd = win32security.GetFileSecurity(
         str(file_path),
         win32con.DACL_SECURITY_INFORMATION | win32con.OWNER_SECURITY_INFORMATION,
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
-        assert False, "All users have access to the file."
+        assert False, "No DACL found - all users have access to the file."
+
+    # Track permissions for allowed entities
+    current_user_permissions = 0
+    admin_permissions = 0
+    other_sids_found = []
 
-    # Iterate through each ACE in the DACL
+    # Explicit check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
 
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, (
+                f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+            )
+
+        if sid == current_user_sid:
+            current_user_permissions |= ace_mask
+        elif sid == administrators_sid:
+            admin_permissions |= ace_mask
+        else:  # We already checked Users group
+            # Keep track of any other SIDs that have access
+            other_sids_found.append((win32security.LookupAccountSid(None, sid)[0], ace_mask))
+
+    # Check that no other SIDs have access
+    assert not other_sids_found, f"Found unexpected SIDs with access: {other_sids_found}"
+
+    # Define required permissions for current user and admin.
+    # This is the scoped down set from checking the underlying application.
+    required_permissions = (
path: test/integ/startup/test_host_configuration.py
user: login: leongdl
body: Updated - based on understanding `FULL_CONTROL`, this actually translates as follows:

```
Let me compare 2032127 with ntsecuritycon.GENERIC_ALL (0x10000000 or 268435456):

# GENERIC_ALL includes all possible permissions
GENERIC_ALL = 0x10000000  # 268435456

# Current permissions: 2032127
# In binary: 0001 1111 0000 0000 1111 1111

# Missing permissions compared to GENERIC_ALL:
# - MAXIMUM_ALLOWED (0x02000000)
# - ACCESS_SYSTEM_SECURITY (0x01000000)
# - GENERIC_READ (0x80000000)
# - GENERIC_WRITE (0x40000000)
# - GENERIC_EXECUTE (0x20000000)

# The GENERIC_* flags are actually mapped to specific permissions:
# GENERIC_READ maps to FILE_GENERIC_READ
# GENERIC_WRITE maps to FILE_GENERIC_WRITE
# GENERIC_EXECUTE maps to FILE_GENERIC_EXECUTE

The main difference is that GENERIC_ALL includes the generic access rights (GENERIC_READ, GENERIC_WRITE, GENERIC_EXECUTE) which are high-level permission masks that get mapped to specific permissions, while 2032127 has the specific low-level permissions directly.

```
created_at: 2025-04-30T00:41:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -335,41 +335,76 @@ def _windows_file_permissions_test(file_path: str) -> None:
     import win32security
     import ntsecuritycon
 
-    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    # Get relevant SIDs
     current_user_sid, _, _ = win32security.LookupAccountName(None, getpass.getuser())
+    administrators_sid, _, _ = win32security.LookupAccountName(None, "Administrators")
+    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+
+    # Get security descriptor
     sd = win32security.GetFileSecurity(
         str(file_path),
         win32con.DACL_SECURITY_INFORMATION | win32con.OWNER_SECURITY_INFORMATION,
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
-        assert False, "All users have access to the file."
+        assert False, "No DACL found - all users have access to the file."
+
+    # Track permissions for allowed entities
+    current_user_permissions = 0
+    admin_permissions = 0
+    other_sids_found = []
 
-    # Iterate through each ACE in the DACL
+    # Explicit check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
 
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, (
+                f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+            )
+
+        if sid == current_user_sid:
+            current_user_permissions |= ace_mask
+        elif sid == administrators_sid:
+            admin_permissions |= ace_mask
+        else:  # We already checked Users group
+            # Keep track of any other SIDs that have access
+            other_sids_found.append((win32security.LookupAccountSid(None, sid)[0], ace_mask))
+
+    # Check that no other SIDs have access
+    assert not other_sids_found, f"Found unexpected SIDs with access: {other_sids_found}"
+
+    # Define required permissions for current user and admin.
+    # This is the scoped down set from checking the underlying application.
+    required_permissions = (
path: test/integ/startup/test_host_configuration.py
user: login: leongdl
body: I asked Q  to help properly understand this :)
created_at: 2025-04-30T00:41:37Z
author_association: CONTRIBUTOR
diff_hunk: @@ -124,8 +124,14 @@ def _prepare_file_permissions(self):
         touch_file(
             file_path=Path(self._logfile),
             agent_user_permission=FileSystemPermissionEnum.FULL_CONTROL,
+            group="Administrators",
path: src/deadline_worker_agent/windows/win_admin_runner.py
user: login: AWS-Samuel
body: Does the group `Administrators` always exist, or is it OS language dependant? If it is language dependant we may want to consider using the [well known SID](https://learn.microsoft.com/en-us/windows/win32/secauthz/well-known-sids) instead
created_at: 2025-04-30T14:35:45Z
author_association: CONTRIBUTOR
diff_hunk: @@ -124,8 +124,14 @@ def _prepare_file_permissions(self):
         touch_file(
             file_path=Path(self._logfile),
             agent_user_permission=FileSystemPermissionEnum.FULL_CONTROL,
+            group="Administrators",
path: src/deadline_worker_agent/windows/win_admin_runner.py
user: login: leongdl
body: https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts

Yes as per windows `Administrators` always exists.
created_at: 2025-04-30T18:35:11Z
author_association: CONTRIBUTOR
diff_hunk: @@ -124,8 +124,14 @@ def _prepare_file_permissions(self):
         touch_file(
             file_path=Path(self._logfile),
             agent_user_permission=FileSystemPermissionEnum.FULL_CONTROL,
+            group="Administrators",
path: src/deadline_worker_agent/windows/win_admin_runner.py
user: login: AWS-Samuel
body: Thanks for confirming
created_at: 2025-04-30T20:52:02Z
author_association: CONTRIBUTOR
diff_hunk: @@ -335,41 +335,82 @@ def _windows_file_permissions_test(file_path: str) -> None:
     import win32security
     import ntsecuritycon
 
-    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    # Get relevant SIDs
     current_user_sid, _, _ = win32security.LookupAccountName(None, getpass.getuser())
+    administrators_sid, _, _ = win32security.LookupAccountName(None, "Administrators")
+    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+
+    # Get security descriptor
     sd = win32security.GetFileSecurity(
         str(file_path),
         win32con.DACL_SECURITY_INFORMATION | win32con.OWNER_SECURITY_INFORMATION,
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
-        assert False, "All users have access to the file."
+        assert False, "No DACL found - all users have access to the file."
 
-    # Iterate through each ACE in the DACL
+    # Track permissions for allowed entities
+    current_user_permissions = 0
+    admin_permissions = 0
+    other_sids_found = []
+
+    # Explicit check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
 
+        assert ace_type == ntsecuritycon.ACCESS_ALLOWED_ACE_TYPE, (
path: test/integ/startup/test_host_configuration.py
user: login: leongdl
body: Allow only `aces`
created_at: 2025-04-30T22:03:39Z
author_association: CONTRIBUTOR
diff_hunk: @@ -335,41 +335,82 @@ def _windows_file_permissions_test(file_path: str) -> None:
     import win32security
     import ntsecuritycon
 
-    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    # Get relevant SIDs
     current_user_sid, _, _ = win32security.LookupAccountName(None, getpass.getuser())
+    administrators_sid, _, _ = win32security.LookupAccountName(None, "Administrators")
+    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+
+    # Get security descriptor
     sd = win32security.GetFileSecurity(
         str(file_path),
         win32con.DACL_SECURITY_INFORMATION | win32con.OWNER_SECURITY_INFORMATION,
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
-        assert False, "All users have access to the file."
+        assert False, "No DACL found - all users have access to the file."
 
-    # Iterate through each ACE in the DACL
+    # Track permissions for allowed entities
+    current_user_permissions = 0
+    admin_permissions = 0
+    other_sids_found = []
+
+    # Explicit check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
 
+        assert ace_type == ntsecuritycon.ACCESS_ALLOWED_ACE_TYPE, (
+            f"Unexpected ace type found for sid {sid}"
+        )
+
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, (
+                f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+            )
+
+        if sid == current_user_sid:
path: test/integ/startup/test_host_configuration.py
user: login: leongdl
body: current user and admin only. Any other user asserts. I made a specific `User` group assert since its explicit and very bad.
created_at: 2025-04-30T22:04:09Z
author_association: CONTRIBUTOR
diff_hunk: @@ -335,41 +335,82 @@ def _windows_file_permissions_test(file_path: str) -> None:
     import win32security
     import ntsecuritycon
 
-    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+    # Get relevant SIDs
     current_user_sid, _, _ = win32security.LookupAccountName(None, getpass.getuser())
+    administrators_sid, _, _ = win32security.LookupAccountName(None, "Administrators")
+    users_group_sid, _, _ = win32security.LookupAccountName(None, "Users")
+
+    # Get security descriptor
     sd = win32security.GetFileSecurity(
         str(file_path),
         win32con.DACL_SECURITY_INFORMATION | win32con.OWNER_SECURITY_INFORMATION,
     )
     dacl = sd.GetSecurityDescriptorDacl()
 
-    users_group_permission_found: bool = False
-    current_user_permission_read_found: bool = False
-    current_user_permission_write_found: bool = False
-
     if dacl is None:
-        assert False, "All users have access to the file."
+        assert False, "No DACL found - all users have access to the file."
 
-    # Iterate through each ACE in the DACL
+    # Track permissions for allowed entities
+    current_user_permissions = 0
+    admin_permissions = 0
+    other_sids_found = []
+
+    # Explicit check that Users group has no permissions at all
     for i in range(dacl.GetAceCount()):
         ace = dacl.GetAce(i)
         (ace_type, ace_flags), ace_mask, sid = ace
 
+        assert ace_type == ntsecuritycon.ACCESS_ALLOWED_ACE_TYPE, (
+            f"Unexpected ace type found for sid {sid}"
+        )
+
         if sid == users_group_sid:
-            # Check for read or write permission
-            if (ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ) or (
-                ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE
-            ):
-                users_group_permission_found = True
-        elif sid == current_user_sid:
-            # Check for read permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_READ == ntsecuritycon.FILE_GENERIC_READ:
-                current_user_permission_read_found = True
-
-            # Check for write permission
-            if ace_mask & ntsecuritycon.FILE_GENERIC_WRITE == ntsecuritycon.FILE_GENERIC_WRITE:
-                current_user_permission_write_found = True
-
-    assert not users_group_permission_found
-    assert current_user_permission_read_found
-    assert current_user_permission_write_found
+            assert False, (
+                f"Users group should not have any permissions, but found ACE with mask: {ace_mask}"
+            )
+
+        if sid == current_user_sid:
+            current_user_permissions |= ace_mask
+        elif sid == administrators_sid:
+            admin_permissions |= ace_mask
+        else:  # We already checked Users group
+            # Keep track of any other SIDs that have access
+            other_sids_found.append((win32security.LookupAccountSid(None, sid)[0], ace_mask))
+
+    # Check that no other SIDs have access
+    assert not other_sids_found, f"Found unexpected SIDs with access: {other_sids_found}"
+
+    # Define required permissions for current user and admin.
+    # This is the scoped down set from checking the underlying application.
+    required_permissions = (
+        ntsecuritycon.FILE_READ_DATA  # 0x1
+        | ntsecuritycon.FILE_WRITE_DATA  # 0x2
+        | ntsecuritycon.FILE_APPEND_DATA  # 0x4
+        | ntsecuritycon.FILE_READ_EA  # 0x8
+        | ntsecuritycon.FILE_WRITE_EA  # 0x10
+        | ntsecuritycon.FILE_EXECUTE  # 0x20
+        | ntsecuritycon.FILE_DELETE_CHILD  # 0x40
+        | ntsecuritycon.FILE_READ_ATTRIBUTES  # 0x80
+        | ntsecuritycon.FILE_WRITE_ATTRIBUTES  # 0x100
+        | ntsecuritycon.DELETE  # 0x10000
+        | ntsecuritycon.READ_CONTROL  # 0x20000
+        | ntsecuritycon.WRITE_DAC  # 0x40000
+        | ntsecuritycon.WRITE_OWNER  # 0x80000
+        | ntsecuritycon.SYNCHRONIZE  # 0x100000
+    )
+
+    # Check current user permissions
+    assert current_user_permissions == required_permissions, (
path: test/integ/startup/test_host_configuration.py
user: login: leongdl
body: Only Allowed ACES are scoped exactly to the required permission set.
created_at: 2025-04-30T22:04:35Z
author_association: CONTRIBUTOR

PR comments:
user: login: sonarqubecloud[bot]
created_at: 2025-04-30T21:54:25Z
body: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=aws-deadline_deadline-cloud-worker-agent&pullRequest=609) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=aws-deadline_deadline-cloud-worker-agent&pullRequest=609&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=aws-deadline_deadline-cloud-worker-agent&pullRequest=609&issueStatuses=ACCEPTED)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=aws-deadline_deadline-cloud-worker-agent&pullRequest=609&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=aws-deadline_deadline-cloud-worker-agent&pullRequest=609&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=aws-deadline_deadline-cloud-worker-agent&pullRequest=609&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=aws-deadline_deadline-cloud-worker-agent&pullRequest=609)


author_association: NONE