test(mxc): verify ProcessContainer token isolation

[prekshivyas]

🔧 security-fix-agent ## Summary Validate the ProcessContainer identity concern tracked in internal NVBug 6782979 against the Windows token and access-control APIs. The live runtime retains the launching user and Administrators group metadata, as expected for the AppContainer dual-principal model, while carrying a unique AppContainer SID and being denied an administrator-gated Service Control Manager open. This PR makes that security boundary regression-tested and documents how to interpret the token. ## Related Issue NVBug 6782979 (internal) ## Changes - Add a real-wxc-exec integration probe for TokenIsAppContainer, TokenAppContainerSid, and a non-mutating SC_MANAGER_CREATE_SERVICE open failing specifically with ERROR_ACCESS_DENIED. - Document why retained user/group SIDs do not bypass AppContainer package/capability access checks. - Document the distinction between default AppContainer mode and the optional LPAC mode. - Repair the Windows host proxy call for the current ProxyHandle API so the branch builds. ## Testing - [ ] mise run pre-commit passes - Windows ARM64 tooling blockers: Biome 2.5.4 exits with an access violation, and grpcio-tools 1.78.0 receives incompatible /std:c++17 and /std:c11 flags. - Hosted CI separately reports the shared windows-branch mise.lock drift. - [x] Unit tests added/updated - cargo test -p openshell-driver-mxc -- --test-threads=1 (151 passed, 13 ignored) - [x] E2E tests added/updated - Live A/B identity probe passed for windows base 49b4f0e and the #3468 + #3430 combined tree. - Both sides reported AppContainer enabled, a unique package SID, retained enabled Administrators membership metadata, and SC_MANAGER_CREATE_SERVICE failing with ERROR_ACCESS_DENIED. - Corrected live regression test passed on #3430 and on #3468 head acd2a572 combined with #3430. - The #3468 Windows-tip qualification evidence also records two complete 14-check lifecycle cycles passing in 34m59s. - [x] Focused Clippy passed for both touched crates on aarch64-pc-windows-msvc. - [x] Rust formatting, Markdown lint, and git diff --check passed. ## Checklist - [x] Follows Conventional Commits - [x] Commits are signed off (DCO) - [x] Architecture docs updated (not applicable; operator reference updated)

[prekshivyas]

🔧 security-fix-agent

Qualification evidence

Revisions

• windows baseline: 49b4f0eb7f2af88557ad1a171249c83176e4b505
• Windows-tip qualification fix (#3468): acd2a57219811b21bafa0a15938041c1b6f8bcc5
• This PR: 6417b4a9df1d1f387c894d51aad9c554f5967c81

The same installed MXC runtime and probe executable were used for both sides of the A/B observation. Machine-specific SID values are intentionally omitted.

Token and access results

Check	windows baseline	#3468 + #3430
TokenIsAppContainer	1	1
Launching user SID retained	yes	yes
Non-null, unique TokenAppContainerSid	yes	yes
Administrators SID present	true	true
Administrators SID attributes	0x0000000f	0x0000000f
AppContainer-aware group query	true	true
Open SCM with SC_MANAGER_CREATE_SERVICE	denied	denied
GetLastError() from denied SCM open	5 (ERROR_ACCESS_DENIED)	5 (ERROR_ACCESS_DENIED)

The SCM check is non-mutating: it requests the administrator-gated access right but does not create or modify a service.

This is intentionally not a failing-before/passing-after claim. The PR does not change production token construction. It records the existing security boundary and prevents regression. Windows AppContainer tokens retain traditional user/group metadata, while protected-resource access is the intersection of the user/group and package/capability sides. See Microsoft's AppContainer dual-principal description and AppContainer-aware membership API.

Live validation

• Corrected real-runtime test passed on this PR:
  • pc_oneshot_token_is_appcontainer_without_admin_access
  • Requires both a non-null AppContainer SID and ERROR_ACCESS_DENIED from the SCM open.
• The same corrected test passed after applying test(mxc): verify ProcessContainer token isolation #3430 to exact fix(windows): restore MXC qualification and cold-start readiness #3468 head acd2a572.
• cargo test -p openshell-driver-mxc -- --test-threads=1: 151 passed, 13 intentionally ignored.
• Focused Windows ARM64 Clippy passed for the touched crates.
• Separate Windows-tip qualification on fix(windows): restore MXC qualification and cold-start readiness #3468 completed two create/start/policy/forward/chat/delete cycles in 34m59s; all 14 checks passed in both cycles and no emergency process termination was required.

Conclusion

The reported username and Administrators-group lines are reproducible token metadata. They do not demonstrate administrator access. The direct administrator-gated access attempt is denied by Windows on both the baseline and combined candidate.

[prekshivyas]

Qualification before/after summary

NVBug: 6782979 — ProcessContainer token-isolation concern

Before: The runtime retained launching-user and Administrators-group token metadata, but there was no durable test proving that this metadata did not permit an administrator-gated operation.

After: A real wxc-exec probe confirms TokenIsAppContainer, a unique AppContainer SID, and SC_MANAGER_CREATE_SERVICE denied with ERROR_ACCESS_DENIED. The corrected live test passed both on the original base and on the combined #3468 + #3430 tree. Focused results: 151 passed, 13 intentionally ignored; ARM64 Clippy, formatting, Markdown, and diff checks passed.

Qualification status: Scenario PASS. This PR primarily adds security regression coverage/documentation and does not weaken the runtime boundary. The current hosted red is the shared windows-branch mise.lock drift, not this scenario. Full #3468 qualification was 2/2 cycles with 14/14 checks; CI should be rerun after the shared lockfile repair.