Repository navigation
[medium] Enforce and verify private Windows ACLs for Pi child credentials #415
Description
Activity
Superseded by #455.
This issue asked for private Windows ACLs on the projected child credential file. Under the #455 broker design there is no projected credential file: ADR-0016's
auth.jsonprojection is deleted outright and the child receives a per-child ephemeral token instead of the operator's credential.Closing rather than implementing — hardening the permissions of a file that is being removed would be wasted work. If the broker design changes such that any credential-bearing file returns to the child boundary, this should be reopened.
Finding
ca-pi creates the private child root beneath the platform temp directory and requests POSIX-style 0700 directories and 0600 files. On Windows, those mode bits do not establish or verify a private ACL. Access inherits from the configured temp directory.
Impact
A shared or weakened temp-directory ACL can expose the projected auth.json to another local identity even though the path is ephemeral.
Required resolution
Create the child root with a Windows-native private ACL, verify that only the current identity and required system principals can access it, and fail closed before credential projection when verification is unavailable or inconclusive. Add Windows regression coverage for permissive inherited ACLs and verification failure.
Related: #372 and ADR-0016.