fix(cli): attribute activation refusals to the recorded safety check (#1416) - #1449
Open
DeusData wants to merge 1 commit into
Open
fix(cli): attribute activation refusals to the recorded safety check (#1416)#1449DeusData wants to merge 1 commit into
DeusData wants to merge 1 commit into
Conversation
…1416) Windows users hit 'active CBM sessions and operations could not be stopped safely; no activation was committed' from install, uninstall and doctor with ZERO CBM processes running - they rebooted, killed phantom handles, and deleted runtime folders chasing sessions that did not exist. The real failure was the activation transaction's Windows ACL safety check refusing a directory carrying cross-account mutation grants (commonly the stock Authenticated Users:(M) inheritance from a drive root - reproduced on the Windows VM with a plain mkdir under C:\ and with an icacls-granted parent), and the refusal detail was recorded internally but never shown. cli_activation_diagnostic now prefixes the recorded refusal note - the predicate, SID and path - plus one remediation line (remove the flagged grant or use an owner-private directory). The sessions wording remains for genuine stop/reservation failures, which record no note. Adds a CBM_ENABLE_TEST_SEAMS setter for the refusal note so the attribution is testable portably; the regression test asserts the note reaches the diagnostic (and that the no-note path keeps the sessions text). RED before the fix, GREEN after, RED again on revert. Verified end-to-end on the Windows VM: uninstall/doctor against an ACL-tainted tree now name the ACL check instead of sessions. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
DeusData
enabled auto-merge
August 4, 2026 19:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1416 (the misattribution half — the actionable-error fix).
Reproduced on the Windows VM
A directory carrying the stock
Authenticated Users:(M)inheritance from a drive root (any plainmkdirunderC:\, most secondary-drive paths) trips the activation transaction's ACL safety check. The refusal was recorded internally — predicate, SID, path — butinstall/uninstall/doctorsurfaced only:Both reporters killed processes, rebooted, and hunted phantom handles because the message points at sessions that never existed.
Fix
cli_activation_diagnosticnow prefixes the recorded refusal note plus one remediation line (remove the flagged grant via icacls, or choose an owner-private--dir/CBM_CACHE_DIR). The sessions wording remains for genuine stop/reservation failures, which record no note. No change to what is accepted or refused — attribution only.Verification
CBM_ENABLE_TEST_SEAMSrefusal-note setter: note ⇒ diagnostic names the check, no note ⇒ sessions text intact. RED → GREEN → RED-on-revert.clisuite 258 passed,lint-ciclean.uninstall/doctornow name the ACL check.Deliberately NOT in this PR (maintainer decision pending)
Whether the ACL gate should tolerate ancestor-inherited cross-account grants when the final directory is owner-private with a protected DACL — that decides whether default secondary-drive installs work at all, and it's a security-posture question, not a bug fix. Decision matrix goes to the maintainer separately. The #1351 empty-ACL destruction did not reproduce in any VM variant (files stayed owner-usable through daemon-refusal, failed install, failed uninstall); reporter question outstanding.