Add shared typed AccessControlList library

[Steve Lee (SteveL-MSFT)]

Windows ACL handling was duplicated across the filesystem and registry resources and exposed raw SDDL. This change introduces a shared typed model so both resources can manage DACLs and SACLs consistently through structured ACE objects.

Changes

• Add lib-acl with Win32-backed security descriptor, SID resolution, privilege, DACL, and SACL management.
• Represent ACE access masks with resource-specific permission enums and accept either usernames or SIDs as principals.
• Rename the filesystem resource to Microsoft.Filesystem/AccessControlList and replace raw SDDL inputs with accessControlList.
• Replace the registry acl property with the same typed accessControlList shape.
• Add _purge, defaulting to true; _purge: false merges ACL entries, removes semantic duplicates, and canonicalizes DACLs with deny ACEs first.
• Update schemas, registry documentation, localization, and filesystem/registry integration coverage.

This intentionally changes the existing public ACL schema and filesystem resource type name. Reviewers should pay particular attention to permission mappings, SACL privilege handling, and merge/canonicalization semantics.

Validation

./build.ps1 -Project lib-acl,dsc-lib-registry,file_dsc,registry -Clippy -Test

[Copilot]

🟡 Changes recommended

Unresolved permission-preservation, native memory-safety, privilege-handling, and desired-state comparison issues block approval.

13 open issues

• Add native registry Test with ACL satisfaction checks · New
• Preserve canonical explicit and inherited ACE ordering · New
• Preserve unrepresentable and generic ACL mask bits · New
• Validate security descriptor buffers before native access · New
• Distinguish NULL DACLs from empty DACLs · New
• Make raw SID conversion unsafe or require validation · New
• Reject empty ACL requests before registry operations · New
• Enable SeSecurityPrivilege before SACL access checks · New
• Remove registry view flags from ACE access masks · New
• Compute merged ACLs for existing-key what-if previews · New
• Apply purge-mode defaults when comparing protection · New
• Compare effective permission masks during ACL satisfaction · New
• Recognize SIDs without rejecting hyphenated account names · New

What changed in this PR

Introduces a shared typed ACL library to replace duplicated SDDL handling in filesystem and registry resources.

Changes:

• Adds structured permissions, principal resolution, and DACL/SACL operations.
• Migrates resource inputs to accessControlList with replacement and merge modes.
• Updates schemas, documentation, build registration, and integration tests.

File	Description
resources/​registry/​tests/​registrylist_whatif.tests.ps1	Updates list ACL previews.
resources/​registry/​tests/​registrylist_set.tests.ps1	Tests typed list ACL writes.
resources/​registry/​tests/​registrylist_get.tests.ps1	Tests typed list ACL reads.
resources/​registry/​tests/​registry.config.whatif.tests.ps1	Updates ACL preview assertions.
resources/​registry/​tests/​registry.config.set.tests.ps1	Covers replacement and merge behavior.
resources/​registry/​tests/​registry.config.get.tests.ps1	Updates ACL read and validation tests.
resources/​file_dsc/​tests/​filesystem_acl.tests.ps1	Covers typed ACLs, merging, and auditing.
resources/​file_dsc/​src/​types.rs	Defines filesystem permissions and ACL input.
resources/​file_dsc/​src/​main.rs	Uses the renamed input type.
resources/​file_dsc/​src/​acl.rs	Integrates shared ACL operations.
resources/​file_dsc/​locales/​en-us.toml	Updates ACL diagnostics.
resources/​file_dsc/​file_dsc.dsc.manifests.json	Renames resource and defines typed schema.
resources/​file_dsc/​Cargo.toml	Adds shared library dependency.
lib/​lib-acl/​src/​win32/​sid.rs	Resolves and formats principals.
lib/​lib-acl/​src/​win32/​security_descriptor.rs	Reads and builds security descriptors.
lib/​lib-acl/​src/​win32/​privilege.rs	Enables SACL privileges.
lib/​lib-acl/​src/​win32/​mod.rs	Exposes Windows ACL helpers.
lib/​lib-acl/​src/​win32/​acl.rs	Parses and builds native ACLs.
lib/​lib-acl/​src/​model.rs	Defines ACL models, merging, and comparison.
lib/​lib-acl/​src/​lib.rs	Exposes the shared library API.
lib/​lib-acl/​src/​error.rs	Defines shared ACL errors.
lib/​lib-acl/​Cargo.toml	Declares the new crate.
lib/​lib-acl/​.project.data.json	Registers library metadata.
lib/​dsc-lib-registry/​src/​lib.rs	Integrates typed ACLs and previews.
lib/​dsc-lib-registry/​src/​config.rs	Defines registry permissions and ACL property.
lib/​dsc-lib-registry/​src/​acl.rs	Uses shared Windows ACL handling.
lib/​dsc-lib-registry/​locales/​en-us.toml	Updates registry ACL diagnostics.
lib/​dsc-lib-registry/​Cargo.toml	Adds shared library dependency.
docs/​reference/​resources/​Microsoft/​Windows/​Registry/​index.md	Documents typed ACL configuration.
data.build.json	Registers the library for builds.
Cargo.toml	Adds workspace integration and Windows support.
Cargo.lock	Records dependency changes.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unresolved ACL convergence, initial auditing, and registry mutation-order issues affect correctness.

4 open issues

• Validate principals and SACL privileges before registry mutation · New
• Treat absent SACLs as empty audit lists · New
• Generic permission masks cause false drift and duplicate grants · New
• Require accessControlList in the ACL resource schema · New

13 resolved since last review

• Make raw SID conversion unsafe or require validation
• Distinguish NULL DACLs from empty DACLs
• Validate security descriptor buffers before native access
• Preserve unrepresentable and generic ACL mask bits
• Preserve canonical explicit and inherited ACE ordering
• Add native registry Test with ACL satisfaction checks
• Recognize SIDs without rejecting hyphenated account names
• Compare effective permission masks during ACL satisfaction
• Apply purge-mode defaults when comparing protection
• Compute merged ACLs for existing-key what-if previews
• Remove registry view flags from ACE access masks
• Enable SeSecurityPrivilege before SACL access checks
• Reject empty ACL requests before registry operations

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The Content resource schema requires a forbidden property, making every instance invalid and blocking its DSC operations.

1 open issue

• Invalid required field blocks all Content instances · New

4 resolved since last review

• Validate principals and SACL privileges before registry mutation
• Require accessControlList in the ACL resource schema
• Generic permission masks cause false drift and duplicate grants
• Treat absent SACLs as empty audit lists

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Security-sensitive registry SACL writes and privilege activation still need reliable regression coverage.

No open issues 🎉

2 previously missed issues

In code that hasn't changed since last review

Add round-trip coverage for registry SACL writes

lib/​dsc-lib-registry/​src/​acl.rs:178

The new registry SACL write has no round-trip test: current registry SACL tests cover access flags, can_set, and what-if, but never execute this RegSetKeySecurity call. Add an elevated Set/Get/Test case in resources/registry/tests/registry.config.set.tests.ps1 that verifies audit entries, systemProtected, and preservation of the unrequested DACL. Use a temporary key with guaranteed cleanup. The filesystem SACL test uses a different Windows setter and does not cover this path.

Privilege availability test leaves SeSecurityPrivilege enabled

lib/​dsc-lib-registry/​src/​acl.rs:471

This availability check enables SeSecurityPrivilege on the process token before can_set runs and leaves it enabled. The test therefore still passes if privilege setup is removed from can_set. Exercise the check against an existing temporary key in an isolated process with the privilege held but initially disabled, and verify that removing privilege setup makes the test fail. Do not disable the shared test process's privilege, since other Rust tests can run concurrently.

1 resolved since last review

• Invalid required field blocks all Content instances

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Security-sensitive Win32 changes and unresolved correctness issues require Windows-focused human review.

1 open issue

• Reject principals containing embedded NUL characters · New

1 previously missed issue

In code that hasn't changed since last review

Prepare ACL changes before writing registry values

lib/​dsc-lib-registry/​src/​lib.rs:417

With _purge: false, a valid request can pass preflight but fail when effective reads an existing DACL containing a conditional or object-specific ACE that parse_acl rejects. If the request also changes a value, reg_key.set_value at line 398 has already run, so the command fails after modifying registry data. For existing keys, prepare the effective merged descriptor before writing the value and reuse it for the ACL write. Add a regression test showing that an unsupported existing ACE leaves the value unchanged.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The security-sensitive Win32 rewrite needs Windows-focused human validation, particularly for inherited-permission previews.

No open issues 🎉

2 previously missed issues

In code that hasn't changed since last review

What-if omits inherited ACL entries for missing keys

lib/​dsc-lib-registry/​src/​acl.rs:263

For a missing key under a parent with inheritable ACEs, _purge: false previews a different ACL from the one Set applies. Real Set creates the key first (lib.rs:310), then reads and merges its inherited entries through prepare (lib.rs:325). This preview starts from an empty ACL, omitting permissions that will remain after Set. Pass the target path into this helper and compute the new key's inherited ACL without mutation before merging. Add a regression test comparing what-if with subsequent Set/Get under a parent with inheritable entries.

Localize ACL error templates and diagnostic reasons

lib/​lib-acl/​src/​error.rs:13

These error templates and the validation/resolution reasons are returned unchanged by both resources, so hard-coded English bypasses localization. The existing registry errors use t!-backed formats (lib/dsc-lib-registry/src/error.rs:10–38). Add rust-i18n initialization and an en-us.toml catalog to lib-acl, and localize both its error templates and diagnostic reasons.

1 resolved since last review

• Reject principals containing embedded NUL characters

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Security-sensitive Win32 ACL writes, privilege handling, and inheritance simulation warrant final Windows-focused human review.

No open issues 🎉

_{Review effort: Balanced}