DSH 0.1.7 introduced an ACL-based sandbox mechanism, requiring commands under the workspace-write policy to pass permission authorization before being spawned. In non-system disk workspaces (such as D:/E:/F:), the default directory ACL does not include FullControl for the creator, and DSH runs under a UAC filtered token. As a result, calling SetNamedSecurityInfoW returns Win32 error 5 due to a missing WRITE_OWNER permission, causing the sandbox to fail closed. dsh-acl-sandbox-patch is a temporary fix plugin that wraps low-level APIs to restore command execution capability.

Plugin Information

dsh-acl-sandbox-patch is a temporary fix plugin for DSH 0.1.7 on Windows, where ACL sandbox command spawning fails before startup for all commands in non-system disk workspaces.

Core Features

  1. Fix failures in non-system disk workspaces: Resolves the issue in DSH 0.1.7 where grantWrite authorization calls fail in non-system disk workspaces, preventing commands from being spawned.
  2. API wrapping and fallback: Wraps SetNamedSecurityInfoW. If writing a Low integrity label fails, it automatically falls back to injecting only the DACL (stripping LABEL_SECURITY_INFORMATION) and relies on the owner’s implicit WRITE_DAC permission to complete authorization.
  3. Token integrity control: Wraps SetTokenInformation. It detects whether the workspace contains a Low integrity mandatory label. If it does not, it skips child process token downgrading to avoid write operations being rejected due to no-write-up policy.
  4. Platform limitation: Windows only; automatically no-ops on other platforms.
  5. Version compatibility: Supports DSH >= 0.1.7-rc.1.

Installation

Install it using the official plugin command, which links the package and records it as a dependency.

dsh plugin --profile web add github:masknull/dsh-acl-sandbox-patch

After installation, restart DSH to activate the new bundle layer. The restart logs should show activation information.

Typical Usage

After installing and restarting DSH, workspace-write commands in new sessions will execute directly without requiring per-command approval.

  1. Run basic commands:
    • whoami
    • echo hi
  2. Verify file operations:
    • Run New-Item inside the sandbox to create a file.
    • Overwrite an existing file.

Notes

  1. Activation method: DSH must be restarted. The plugin is injected via NODE_OPTIONS preloading and only takes effect for new processes after the restart.
  2. Performance impact: The first workspace-write command after a restart is slower because the DACL must be propagated. In a tested workspace with 44,251 files, it took about 20 seconds; subsequent commands in the same process took about 1.7 seconds; a new session took about 2 seconds.
  3. Old Runner issue: For sessions established before the restart, the command channel may still be handled by the old runner (which is not recycled on restart), potentially causing abnormal behavior. Opening a new session restores normal behavior.
  4. Security boundary changes:
    • Retained: WRITE_RESTRICTED token, capability SID Allow ACE, world SID Deny ACE, fail-closed policy.
    • Lost: In the fallback scenario only, the Low integrity mandatory label layer of defense in depth is removed.
  5. Supply-chain security: It is recommended to use a pinned commit version, for example github:masknull/dsh-acl-sandbox-patch#<commit sha>.

Summary

This plugin resolves a compatibility issue in DSH 0.1.7 under specific permission environments by sacrificing part of the integrity label mechanism to restore functionality. Once the upstream sandbox package is upgraded or the issue is fixed upstream, it is recommended to uninstall it promptly.