fix(control): the bridge's pipe lets a sandboxed game's agent in (AppContainer, a farm user) #544

Merged

HumanBean merged 1 commit from HumanBean/Longshot:fix/control-pipe-sandbox into main 2026-11-14 23:31:54 +00:00

Conversation 1 Commits 1 Files changed 6 +281 -18

HumanBean commented 2026-11-14 18:57:09 +00:00

Owner

• Copy link
• Copy Markdown

Why

The Test Farm's Windows agent (Beanstalk) runs the game in a sandbox, either an AppContainer or a dedicated low-rights Windows user. Today the control bridge's pipe admits only the game's own user. So the agent can't reach a game in a low-rights user at all, and an AppContainer game's pipe can't make its next instances.

What changed

• control: pipe_security() in host/control.c now builds the pipe's permissions (DACL) as before, plus two additions:
  • When the game's token is an AppContainer's, the container's SID gets full access (GA). Each new pipe instance is checked against the existing one's DACL, and an AppContainer token needs its own SID granted.
  • HOS_CONTROL_PEER_SID=<SID> grants that account read and write (GRGW), so the agent's own account can connect to a game running as the farm's user. hos_control_peer_sid_check() accepts only a local user account:
    • the form S-1-5-21-a-b-c-RID, with exactly five parts after S-1-5 and a RID of 1000 or more;
    • Windows looks the account up and confirms it's a user;
    • the string round-trips unchanged through Windows' SID conversion.
  • Everyone, Authenticated Users, Users, Administrators and six other well-known SIDs are refused with a log line, and the pipe then stays the current user's alone.
• Nothing else changes: same-user only by default, FILE_FLAG_FIRST_PIPE_INSTANCE, remote clients refused, and Linux's SO_PEERCRED check. Linux needs no counterpart, since the farm's bwrap sandbox runs the game as the same user.
• docs: docs/control.md's Security section covers both additions and the SID rules.
• tests:
  • a Windows-only peersid case in tests/control_test.c, run from tests/test_control.py;
  • new tests/test_control_pipe_security.py. It reads control.c's source for the AppContainer branch, the peer branch and the refused-SID list; it fails if either grant is removed. With LONGSHOT_MINGW set, it also compiles host/control.c and tests/control_test.c for x86_64-w64-mingw32 with -Werror.

Flags and settings

Flag	What it does	Default now	Recommendation	Helps on	Doesn't help on	Untested on
HOS_CONTROL_PEER_SID	lets one more local user account open the control pipe (the farm agent's)	unset: the game's user only	set only by the farm agent in its low-rights-user mode	Windows test farm agents	Linux (no effect)	real Windows

Measurements

No performance change: the pipe's permissions are built once, when the bridge starts.

main: 7ff5256e (2026-11-14)
this PR: fix/control-pipe-sandbox @ 11e884ce

	main @ 7ff5256e	this PR @ 11e884ce
tests/test_control.py (Linux)	pass	pass
tests/test_longshot_ctl.py	pass	38/38 pass
x86_64-w64-mingw32 compile of host/control.c, -Werror	builds	builds

Testing

Tested: on Linux, tests/test_control.py, tests/test_longshot_ctl.py (38/38) and the new tests/test_control_pipe_security.py (source checks, and the llvm-mingw compile of host/control.c and tests/control_test.c). The source check was confirmed to fail when either grant is removed.

Not tested: nothing has run on Windows yet: the DACL as Windows reads it back, the peersid case, and a sandboxed game's pipe. tests/run_all.py wasn't re-run (to keep CPU free).

Needs other testers:

• Windows with a GPU: the Beanstalk agent's beanstalk-agent sandbox-check (both modes) and python -I -B tests/test_control.py, expecting the pipe checks to pass in both sandbox modes (request to open).

Screenshots

Nothing on screen.

Risk and rollback

It only adds grants, and only for an AppContainer game or an explicitly named local user. Without HOS_CONTROL_PEER_SID, and outside an AppContainer, the DACL is the same as before. Reverting the commit restores the old behaviour.

Reviewer notes

hos_control_peer_sid_check() first. GRGW also allows creating pipe instances; a narrower grant would turn away normal clients (.NET's NamedPipeClientStream, a plain open), and this is documented in docs/control.md.

Checklist

For everyone

• One topic.
• The title is a Conventional Commit (type(scope): description).
• Rebased on current main.
• python -I -B tests/run_all.py run and passing (any failure that also fails on main is named above). The touched suites were run; the full suite was not re-run, to keep CPU free (see Testing).
• Tested in the game, or what wasn't is named under Testing.
• Testing filled in: what was tested, what wasn't, and what needs other testers (with test requests).
• Measured: main and this PR at named commits, on the same PC, scene and settings, at least 2 interleaved runs each, the median reported. Not applicable (no performance change).
• No game files, dumps, build output or generated files.
• third_party/ untouched (a new folder with a PROVENANCE.md instead).
• The license is OK: GPL-3.0-or-later, nothing incompatible and nothing decompiled.

If applicable

• AI assistance recorded with Assisted-by: / Co-Authored-By: trailers.
• Flags noted, and the switch reference updated (docs/development.md, the README).
• Host code builds on both Windows (llvm-mingw) and Linux, with UTF-8 paths.
• A game-free test added for the fix, failing on main and passing here.
• Docs updated.

## Why The Test Farm's Windows agent ([Beanstalk](https://git.magicbean.dev/MagicBeanDev/Beanstalk/pulls/3)) runs the game in a sandbox, either an AppContainer or a dedicated low-rights Windows user. Today the control bridge's pipe admits only the game's own user. So the agent can't reach a game in a low-rights user at all, and an AppContainer game's pipe can't make its next instances. ## What changed - **control:** `pipe_security()` in `host/control.c` now builds the pipe's permissions (DACL) as before, plus two additions: - **When the game's token is an AppContainer's**, the container's SID gets full access (`GA`). Each new pipe instance is checked against the existing one's DACL, and an AppContainer token needs its own SID granted. - **`HOS_CONTROL_PEER_SID=<SID>`** grants that account read and write (`GRGW`), so the agent's own account can connect to a game running as the farm's user. `hos_control_peer_sid_check()` accepts only a local user account: - the form `S-1-5-21-a-b-c-RID`, with exactly five parts after `S-1-5` and a RID of 1000 or more; - Windows looks the account up and confirms it's a user; - the string round-trips unchanged through Windows' SID conversion. - Everyone, Authenticated Users, Users, Administrators and six other well-known SIDs are refused with a log line, and the pipe then stays the current user's alone. - Nothing else changes: same-user only by default, `FILE_FLAG_FIRST_PIPE_INSTANCE`, remote clients refused, and Linux's `SO_PEERCRED` check. Linux needs no counterpart, since the farm's bwrap sandbox runs the game as the same user. - **docs:** `docs/control.md`'s Security section covers both additions and the SID rules. - **tests:** - a Windows-only `peersid` case in `tests/control_test.c`, run from `tests/test_control.py`; - new `tests/test_control_pipe_security.py`. It reads `control.c`'s source for the AppContainer branch, the peer branch and the refused-SID list; it fails if either grant is removed. With `LONGSHOT_MINGW` set, it also compiles `host/control.c` and `tests/control_test.c` for `x86_64-w64-mingw32` with `-Werror`. ## Flags and settings | Flag | What it does | Default now | Recommendation | Helps on | Doesn't help on | Untested on | |---|---|---|---|---|---|---| | `HOS_CONTROL_PEER_SID` | lets one more local user account open the control pipe (the farm agent's) | unset: the game's user only | set only by the farm agent in its low-rights-user mode | Windows test farm agents | Linux (no effect) | real Windows | ## Measurements No performance change: the pipe's permissions are built once, when the bridge starts. main: 7ff5256e (2026-11-14) this PR: fix/control-pipe-sandbox @ 11e884ce | | main @ 7ff5256e | this PR @ 11e884ce | |---|---|---| | `tests/test_control.py` (Linux) | pass | pass | | `tests/test_longshot_ctl.py` | pass | 38/38 pass | | `x86_64-w64-mingw32` compile of `host/control.c`, `-Werror` | builds | builds | ## Testing **Tested:** on Linux, `tests/test_control.py`, `tests/test_longshot_ctl.py` (38/38) and the new `tests/test_control_pipe_security.py` (source checks, and the llvm-mingw compile of `host/control.c` and `tests/control_test.c`). The source check was confirmed to fail when either grant is removed. **Not tested:** nothing has run on Windows yet: the DACL as Windows reads it back, the `peersid` case, and a sandboxed game's pipe. `tests/run_all.py` wasn't re-run (to keep CPU free). **Needs other testers:** - Windows with a GPU: the Beanstalk agent's `beanstalk-agent sandbox-check` (both modes) and `python -I -B tests/test_control.py`, expecting the pipe checks to pass in both sandbox modes (request to open). ## Screenshots Nothing on screen. ## Risk and rollback It only adds grants, and only for an AppContainer game or an explicitly named local user. Without `HOS_CONTROL_PEER_SID`, and outside an AppContainer, the DACL is the same as before. Reverting the commit restores the old behaviour. ## Reviewer notes `hos_control_peer_sid_check()` first. `GRGW` also allows creating pipe instances; a narrower grant would turn away normal clients (.NET's `NamedPipeClientStream`, a plain open), and this is documented in `docs/control.md`. ## Checklist ### For everyone - [x] One topic. - [x] The title is a Conventional Commit (`type(scope): description`). - [x] Rebased on current `main`. - [x] `python -I -B tests/run_all.py` run and passing (any failure that also fails on `main` is named above). The touched suites were run; the full suite was not re-run, to keep CPU free (see Testing). - [x] Tested in the game, or what wasn't is named under Testing. - [x] Testing filled in: what was tested, what wasn't, and what needs other testers (with test requests). - [x] Measured: main and this PR at named commits, on the same PC, scene and settings, at least 2 interleaved runs each, the median reported. Not applicable (no performance change). - [x] No game files, dumps, build output or generated files. - [x] `third_party/` untouched (a new folder with a `PROVENANCE.md` instead). - [x] The license is OK: GPL-3.0-or-later, nothing incompatible and nothing decompiled. ### If applicable - [x] AI assistance recorded with `Assisted-by:` / `Co-Authored-By:` trailers. - [x] Flags noted, and the switch reference updated (docs/development.md, the README). - [x] Host code builds on both Windows (llvm-mingw) and Linux, with UTF-8 paths. - [x] A game-free test added for the fix, failing on `main` and passing here. - [x] Docs updated.

HumanBean added 1 commit 2026-11-14 18:57:09 +00:00

fix(control): the bridge's pipe lets a sandboxed game's agent in (AppContainer, a farm user) ... c67b3215c4

The Beanstalk Test Farm agent runs the game in an AppContainer, or as the
local user beanstalk-runner, and connects to its control pipe from outside.
pipe_security() granted the current user alone, which broke both:

- In an AppContainer, a new pipe instance (for the next client) is checked
  against the pipe's DACL with the game's token, and an AppContainer's check
  also needs its own SID. Only the first client could connect. When the token
  is an AppContainer's (TokenIsAppContainer), its TokenAppContainerSid now
  gets GA too.
- As another account, the agent's user could not connect at all.
  HOS_CONTROL_PEER_SID names one more account, granted GRGW. It must be a
  user's SID: canonical (ConvertStringSidToSidA, IsValidSid, and the string
  round-trips), S-1-5-21- with five sub-authorities, a RID of 1000 or more,
  and SidTypeUser from LookupAccountSidA. Well-known groups (Everyone,
  Authenticated Users, Users, Administrators, ...) are refused by name. A
  refusal is logged, and the pipe stays this user's alone.

Nothing else changes: D:P, FILE_FLAG_FIRST_PIPE_INSTANCE, remote clients
refused, and Linux's SO_PEERCRED check (the farm's bwrap runs the game as the
same user there). docs/control.md's Security section describes both
additions. GRGW includes FILE_CREATE_PIPE_INSTANCE, and the docs say so.

Tests: control_test peersid (Windows) runs the SID check.
tests/test_control_pipe_security.py checks the source and compiles control.c
and control_test.c for x86_64-w64-mingw32 when LONGSHOT_MINGW is set.

Assisted-by: Claude Code
Co-Authored-By: Claude Opus 5.5 <[email protected]>

HumanBean commented 2026-11-14 18:57:27 +00:00

Author

Owner

• Copy link
• Copy Markdown

Pushed: HOS_CONTROL_PEER_SID is now in docs/development.md's switch reference too, next to HOS_CONTROL.

Pushed: HOS_CONTROL_PEER_SID is now in docs/development.md's switch reference too, next to HOS_CONTROL.

HumanBean force-pushed fix/control-pipe-sandbox from c67b3215c4 to 11e884ce38 2026-11-14 18:57:27 +00:00 Compare

HumanBean changed title from WIP: fix(control): the bridge's pipe lets a sandboxed game's agent in (AppContainer, a farm user) to fix(control): the bridge's pipe lets a sandboxed game's agent in (AppContainer, a farm user) 2026-11-14 23:31:47 +00:00

HumanBean merged commit 225c37f869 into main 2026-11-14 23:31:54 +00:00

HumanBean referenced this pull request from a commit 2026-11-14 23:31:55 +00:00

fix(control): the bridge's pipe lets a sandboxed game's agent in (AppContainer, a farm user) (#544)

HumanBean deleted branch fix/control-pipe-sandbox 2026-11-14 23:31:55 +00:00

mooki referenced this pull request 2026-11-15 00:35:11 +00:00

fix(runtime): translate macOS fault contexts on both CPU routes #436

mooki referenced this pull request 2026-11-15 00:35:13 +00:00

fix(runtime): support control bridge Unix sockets on macOS #456

mooki referenced this pull request 2026-11-15 00:35:14 +00:00

test(control): wait until the bridge listens, and reap it when a quit check fails #457

llun referenced this pull request 2026-11-15 01:18:58 +00:00

feat(ui): the HUD laid out for every screen shape at its 16:9 size, anchored to the screen's edges #95

llun referenced this pull request 2026-11-15 01:18:59 +00:00

WIP: fix(hos): wait at the commit limit for the host's own allocations, then say out of memory #341

MaikelJSQ referenced this pull request 2026-11-15 18:05:02 +00:00

Game: Longshot closed unexpectedly while you were playing #859

HumanBean referenced this pull request 2026-11-15 18:46:15 +00:00

feat(control): relaunch, the game started again over the bridge as the Insert menu's Restart now does #97

dyst referenced this pull request 2026-11-15 19:12:52 +00:00

feat(control): relaunch, the game started again over the bridge as the Insert menu's Restart now does #97

dyst referenced this pull request 2026-11-15 19:12:53 +00:00

feat(control): relaunch, the game started again over the bridge as the Insert menu's Restart now does #97

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area/accessibility

Barriers for people with disabilities

  

area/audio

Sound and music

  

area/input

Controllers, keyboard, mouse

  

area/install

Installing, updating, building from your game

  

area/menu

In-game menu and settings

  

area/renderer

Vulkan renderer, shaders, effects

  

area/saves

Save files

  

area/upscaling

DLSS, FSR, frame generation

  

beanstalk: approved @ 1697603

Set by Beanstalk for show; the farm's database is what counts

  

beanstalk: approved @ 2c5a62e

Set by Beanstalk for show; the farm's database is what counts

  

beanstalk: approved @ 4fd82b7

Set by Beanstalk for show; the farm's database is what counts

  

beanstalk: approved @ 64d6d09

Set by Beanstalk for show; the farm's database is what counts

  

beanstalk: approved @ 6f91fae

Set by Beanstalk for show; the farm's database is what counts

  

beanstalk: approved @ 70a78f9

Set by Beanstalk for show; the farm's database is what counts

  

beanstalk: approved @ 8015c9a

Set by Beanstalk for show; the farm's database is what counts

  

beanstalk: approved @ 8d361dc

Set by Beanstalk for show; the farm's database is what counts

  

beanstalk: approved @ 9d8356e

Set by Beanstalk for show; the farm's database is what counts

  

beanstalk: approved @ abf2227

Set by Beanstalk for show; the farm's database is what counts

  

beanstalk: approved @ d82f202

Set by Beanstalk for show; the farm's database is what counts

  

beanstalk: approved @ e5f1e40

Set by Beanstalk for show; the farm's database is what counts

  

beanstalk: approved @ ee8ab5f

Set by Beanstalk for show; the farm's database is what counts

  

ci: approved

A maintainer approved CircleCI for this fork PR (sticky; removed after 14 quiet days)

  

good first issue

A good start for a new contributor

  

gpu/amd

AMD GPUs

  

gpu/igpu

Integrated GPUs

  

gpu/intel

Intel GPUs

  

gpu/nvidia

NVIDIA GPUs

  

help wanted

Extra hands or knowledge wanted

  

kind

bug

Something doesn't work as it should

  

kind

chore

Build, CI, dependencies, tidying

  

kind

docs

Documentation

  

kind

feature

A new feature or an improvement

  

kind

performance

Frame rate, frame time, loading, memory

  

kind

question

A question rather than a change

  

needs measurements

Waiting for before/after measurements

  

platform/linux

Affects Linux (a change for every system carries both Windows and Linux)

  

platform/macos

macOS (Apple silicon or Intel Macs)

  

platform/steam-deck

Steam Deck

  

platform/windows

Affects Windows (a change for every system carries both Windows and Linux)

  

preview

Maintainers: deploy a preview of this PR's website (read its changes first). Removed after the run.

  

priority

critical

Crashes, data loss, or blocks most players

  

priority

high

Important: next in line

  

priority

low

Nice to have

  

regression

Worked in an earlier build, broken in a newer one: highest priority, above other bugs

  

status

blocked

Waits on something else first

  

status

confirmed

Reproduced or agreed on

  

status

duplicate

Already reported or proposed

  

status

invalid

Not a problem in this project

  

status

needs-info

Waiting for more information from the reporter

  

status

wontfix

Will not be worked on

  

testing wanted

Wanted: a test on other hardware (posts a test request in #test-requests)

  

ci: approved

No labels

area/accessibility

area/audio

area/input

area/install

area/menu

area/renderer

area/saves

area/upscaling

beanstalk: approved @ 1697603

beanstalk: approved @ 2c5a62e

beanstalk: approved @ 4fd82b7

beanstalk: approved @ 64d6d09

beanstalk: approved @ 6f91fae

beanstalk: approved @ 70a78f9

beanstalk: approved @ 8015c9a

beanstalk: approved @ 8d361dc

beanstalk: approved @ 9d8356e

beanstalk: approved @ abf2227

beanstalk: approved @ d82f202

beanstalk: approved @ e5f1e40

beanstalk: approved @ ee8ab5f

ci: approved

good first issue

gpu/amd

gpu/igpu

gpu/intel

gpu/nvidia

help wanted

kind

bug

kind

chore

kind

docs

kind

feature

kind

performance

kind

question

needs measurements

platform/linux

platform/macos

platform/steam-deck

platform/windows

preview

priority

critical

priority

high

priority

low

regression

status

blocked

status

confirmed

status

duplicate

status

invalid

status

needs-info

status

wontfix

testing wanted

ci: approved

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

MagicBeanDev/Longshot!544

No description provided.