Windows sandbox hardening: LPAC, a separate desktop, safe DLL search and narrower grants
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- typescript
- Domain
- security
Research direction
Start by reading sandbox_windows.ts:157-183 for the PATH grants, then trace the Windows AppContainer sandbox setup and helper startup for the other audit items. The issue lists several independent hardening changes, including LPAC, desktop isolation, DLL search, environment-variable filtering, and grant revocation; determine scope and tests for each before taking one on. Done means implementing and validating the selected security change without widening sandbox access.
Written by the indexing model from the issue text.
Description
Hardening items for the Windows AppContainer sandbox from the 2026-10-07 security audit. None is an escape on its own.
- LPAC. Set
PROC_THREAD_ATTRIBUTE_ALL_APPLICATION_PACKAGES_POLICY = PROCESS_CREATION_ALL_APPLICATION_PACKAGES_OPT_OUT. Today the sandbox inherits everything ALL APPLICATION PACKAGES can reach: system folders, HKLM read access, and in-box COM/ALPC/named-pipe endpoints. LPAC needs explicit grants but greatly reduces what the sandbox can talk to. - Separate desktop. Use a separate window station and desktop (
CreateDesktopWpluslpDesktop). Commands shareWinSta0\Defaulttoday, so screen capture and keyboard-state polling may be possible (not tested). - DLL search order. Call
SetDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32)at helper startup, or link with/DEPENDENTLOADFLAG:0x800. The per-user install folder is writable. - PATH grants.
windowsPolicy.addgrants recursive read access to PATH entries inside the home folder (sandbox_windows.ts:157-183). Limit this to folders that hold executables. - Env allow-list.
sandboxEnvAllowListaccepts names thatisSecretEnvNamematches. Refuse them or ask a second time. - Stale grants. Revoke project grants when the app starts for projects no longer in the recent list, and on uninstall.
- Dominant language
- TypeScript
- Stars
- 2
- Forks
- 2
- Avg merge
- 5h 28m
- Merged PRs (30d)
- 24
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PierrunoYT/patch
-
enhancement platform: windows priority: low severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
PierrunoYT/patch#198 ·
Maintainers usually reply within 1 day
-
priority: medium security severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
PierrunoYT/patch#66 ·
Maintainers usually reply within 1 day
-
bug platform: macos priority: low severity: low tests
Difficulty 3/5 1-2 days Newbie friendliness 56/100
PierrunoYT/patch#218 · 1 comment ·
Maintainers usually reply within 1 day
-
enhancement priority: low security severity: low
Difficulty 4/5 3-5 days Newbie friendliness 55/100
PierrunoYT/patch#211 · 2 comments ·
Maintainers usually reply within 1 day
-
enhancement platform: windows priority: low security severity: low
Difficulty 4/5 3-5 days Newbie friendliness 55/100
PierrunoYT/patch#207 ·
Maintainers usually reply within 1 day
All issues in PierrunoYT/patch
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 1-3 hours Newbie friendliness 84/100
answerLoops/answerLoops#345 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 82/100
siyuan-note/siyuan#20313 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
LanternOps/breeze#8254 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 1-3 hours Newbie friendliness 82/100
gofish-graphics/gofish-graphics#1084 ·
Maintainers usually reply within 1 day