Add --prepare-nul to grant AppContainer access to the NUL device

NUL is \Device\Null, a device object, so its DACL cannot be reached through the
SE_FILE_OBJECT named-object provider; it has to be read and written through an
open handle with GetKernelObjectSecurity/SetKernelObjectSecurity instead.

The kernel recreates \Device\Null with a default security descriptor on every
boot, and that default does not grant the AppContainer SIDs, so a sandboxed
child that opens NUL (directly, or by redirecting its stdio there) fails with
ERROR_ACCESS_DENIED. Grant it to ALL APPLICATION PACKAGES and ALL RESTRICTED
APPLICATION PACKAGES rather than to the per-run cesandbox<pid> SID: the device
is machine wide, so a per-run grant would race with concurrently running
sandboxes and would leak an ACE for every crashed run.

This is a standalone maintenance mode with no target executable, meant to run
elevated once per boot, so also guard the progid assignment - it previously
read argv[argc] when no executable followed the flags.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: partouf

CLAUDE.md

@@ -0,0 +1,73 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What this is
+
+`cewrapper.exe` is a Windows-only jailing wrapper used by Compiler Explorer to run untrusted executables (compilers, user programs) under an AppContainer sandbox plus a Job object with resource limits. It is a single-binary MSVC C++ project — no CMake, no package manager, no test suite.
+
+```
+cewrapper.exe [-v|-vv] [--summary] [--config=C:\path\config.json] [--home=C:\cwd]
+              [--time_limit=<seconds>] [--suspend] [--wait] C:\full\path\to\exe.exe [args...]
+cewrapper.exe --prepare-nul
+```
+
+`--prepare-nul` is a standalone maintenance mode (no target exe): it grants the app package SIDs access
+to `\Device\Null` and exits. It must run elevated, once per boot — the kernel resets that DACL at boot
+and the default locks AppContainers out of `NUL`. `infra/init/start.ps1` calls it via `PrepareNulDevice`.
+
+Note the `--time_limit=` value is in **seconds** and is multiplied by 1000 into `time_limit_ms`.
+
+## Build
+
+MSVC only, x64 only, `Debug|x64` and `Release|x64` configurations, toolset v142, `/std:c++latest`, warning level 4.
+
+```
+msbuild cewrapper.vcxproj -t:rebuild -property:Configuration=Release -property:Platform=x64
+```
+
+Output lands in `x64\Release\cewrapper.exe`. CI (`.github/workflows/build-test.yml`) runs exactly this on `windows-2022` and publishes the exe as a release artifact on tags. Despite the workflow name there are **no tests** — verification is building plus running the exe manually against a real target program on Windows.
+
+The repo may be checked out on Linux (e.g. inside the Compiler Explorer tree), where nothing compiles: every source file pulls in `windows.h`, `userenv.h`, `aclapi.h`, `winsafer.h`, `ntsecapi.h`. Code changes made there can only be reviewed by reading, not built.
+
+Formatting: clang-format with the checked-in `.clang-format` (Allman braces, 4 spaces, 120 cols, `AccessModifierOffset: 0` so `private:`/`public:` sit at member indent).
+
+Adding a source file means editing `cewrapper.vcxproj` (`ClCompile`/`ClInclude` item groups) and ideally `cewrapper.vcxproj.filters`.
+
+## Architecture
+
+`wmain` (`src/main.cpp`) parses config, constructs one `Job`, then dispatches to one of two sandboxing strategies:
+
+- `execute_using_appcontainer` — the default (`use_appcontainer: true`). Creates an `AppContainer`, builds a `STARTUPINFOEX` carrying `PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES`, grants the container SID ACLs on the home dir and each configured path/registry key, spawns, then revokes the path ACLs afterwards.
+- `execute_using_lower_rights` — fallback when `use_appcontainer` is false. Uses the Safer API (`SaferCreateLevel` / `SaferComputeTokenFromLevel` at `SAFER_LEVELID_NORMALUSER`) and `CreateProcessAsUserW`.
+
+Both funnel into `SpawnProcess`, which is the only place a process is created. Invariant: the child is **always** created `CREATE_SUSPENDED`, assigned to the job with `job.AddProcess` while still suspended, and only then resumed (unless `--suspend`). Don't reorder that — a process that starts before it is in the job escapes the limits. `SpawnProcess` also sets `lpDesktop` to `winsta0\default`; without it AppContainer children can die with `0xc0000142` (STATUS_DLL_INIT_FAILED).
+
+Module responsibilities:
+
+- `config.{hpp,cpp}` — `Config` is a **process-global singleton** (`Config::get()`, backed by a file-scope `_main_config`). CLI flags are parsed in order until the first non-flag argument, which becomes `progid`; everything after is `args`. `--config=` loads the JSON via the vendored `3rdparty/nlohmann/json.hpp`. `Job` and `AppContainer` each take `const Config` **by value**, so config mutated after their construction won't be seen by them.
+- `appcontainer.{hpp,cpp}` — profile is named `cesandbox<pid>`, created in the constructor and deleted in the destructor. `InitializeCapabilities()` builds the `SID_AND_ATTRIBUTES` vector; `sec_cap.CapabilityCount` is derived from `capabilities.size()`, so capabilities can be added/removed by editing only that function. The `capabilities` vector is the backing store for `sec_cap.Capabilities` and must outlive any use of `sec_cap`. `DeriveCapabilitySidsFromName` is resolved dynamically from `KernelBase.dll` (not in an import lib).
+- `job.{hpp,cpp}` — job named `cejob<pid>`, always sets `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE`; process/time/memory limits are only applied when the corresponding config value is > 0. Destructor terminates the job, prints the `--summary`/`-vv` stats, then closes the handle.
+- `access.{hpp,cpp}` — read-modify-write of DACLs via `GetNamedSecurityInfoW` / `SetEntriesInAclW` / `SetNamedSecurityInfoW`, for `SE_FILE_OBJECT` and the three registry views. `grant_access_to_nul_device` is the exception: `NUL` is a device object, not a file object, so it goes through `CreateFileW(L"\\\\.\\NUL", READ_CONTROL | WRITE_DAC, …)` plus `GetKernelObjectSecurity` / `SetKernelObjectSecurity`. Don't try to reach it with `SE_FILE_OBJECT` — that was tried in `28751a1`..`5786c0a` and does not work.
+- `checks.{hpp,cpp}` — error funnel. `CheckWin32`/`CheckStatus` print via `FormatMessageW` and `throw std::exception`, caught in `wmain`; `CheckStatusAllowFail` only warns. AppContainer creation failures call `abort()` instead of throwing.
+- `exitcodes.hpp` — `SpecialExitCode` values collide with real child exit codes by design-so-far (see the `todo` in that file); the wrapper returns the child's exit code on the normal path.
+
+## Config JSON
+
+```json
+{
+  "use_appcontainer": true,
+  "mem_max": 0,
+  "pids_max": 0,
+  "allowed_paths":    [{ "path": "C:\\some\\dir", "rw": false, "noexec": false }],
+  "allowed_registry": [{ "path": "MACHINE\\Software\\...", "rw": false, "type": "normal" }]
+}
+```
+
+Paths get `GENERIC_READ`, plus `GENERIC_WRITE` if `rw`, plus `GENERIC_EXECUTE` unless `noexec`. Registry keys get `GENERIC_READ`, or `GENERIC_ALL` if `rw`; `type` is `normal` | `wow6464` | `wow6432`. `allowed_paths` and `allowed_registry` are indexed unconditionally (`data["allowed_paths"]`), so both keys must be present.
+
+## Known landmines
+
+- `Config::loadFromFile` selects the registry type with `jsregtype.compare("wow6464")` used as a boolean. `std::string::compare` returns 0 on equality, so those branches are inverted — every type other than `wow6464` currently resolves to `wow6464`. Fix carefully if you touch it; existing configs may depend on the current behaviour.
+- Path ACLs granted to the container SID are revoked at the end of `execute_using_appcontainer`, but registry grants are never revoked.
+- If the process crashes and a later run reuses the same PID, `CreateAppContainerProfile` returns `ERROR_ALREADY_EXISTS`; the code deletes and recreates the profile in that case.

README.md

@@ -8,6 +8,17 @@ jailing wrapper for execution of windows applications
 
 for some verboseness, use `cewrapper.exe -v C:\full\path\to\executable.exe arguments`
 
+## host preparation
+
+`cewrapper.exe --prepare-nul`
+
+Grants ALL APPLICATION PACKAGES and ALL RESTRICTED APPLICATION PACKAGES read/write/execute on the NUL
+device (`\Device\Null`). Without this, a sandboxed process that opens `NUL`, or redirects its stdio
+there, fails with access denied.
+
+The kernel recreates `\Device\Null` with a default security descriptor on every boot, so this has to be
+run again after each boot, elevated, before any sandboxed process starts.
+
 ## dev
 
 To format your sourcefiles, use clang-format. Can be downloaded along with llvm [here](https://github.com/llvm/llvm-project/releases/download/llvmorg-15.0.6/LLVM-15.0.6-win64.exe)

include/access.hpp

@@ -6,6 +6,8 @@
 namespace cewrapper
 {
 
+void grant_access_to_nul_device();
+
 void grant_access_to_path(wchar_t *container_sid, wchar_t *dir, uint32_t permissions);
 void grant_access_to_registry(wchar_t *container_sid, wchar_t *key, uint32_t permissions, registry_type_t regtype);
 

include/config.hpp

@@ -21,6 +21,7 @@ struct Config
     bool home_set{};
     bool use_appcontainer{ true };
     bool wait_before_spawn{};
+    bool prepare_nul{};
 
     int pids_max{};
     int64_t mem_max{};

include/exitcodes.hpp

@@ -6,6 +6,7 @@ enum class SpecialExitCode : DWORD
     NotEnoughArgs = 1,
     InvalidArgs = 2,
     ProcessTookTooLong = 3,
+    ErrorPreparingNulDevice = 4,
     ProcessTookTooLongMethod2 = 9,
     ErrorWhenExecutingProcess = 254,
     UnknownErrorWhileWaitingOnProcess = 255,

src/access.cpp

@@ -1,6 +1,72 @@
 #include "../include/access.hpp"
 #include "../include/checks.hpp"
 #include <aclapi.h>
+#include <sddl.h>
+#include <vector>
+
+// NUL resolves to the \Device\Null device object, so the SE_FILE_OBJECT named-object provider does not
+// apply to it and its DACL has to be read and written through an open handle instead.
+//
+// The kernel recreates \Device\Null with a default security descriptor on every boot, and that default
+// does not grant the AppContainer SIDs, so a sandboxed child that opens NUL (directly, or by redirecting
+// its stdio there) fails with ERROR_ACCESS_DENIED. \Device\Null is machine wide and shared by every
+// process, so this grants access to all app packages rather than to a single container SID: a per-run
+// grant would race with concurrently running sandboxes and would leak an ACE for every crashed run.
+//
+// Must be run elevated (WRITE_DAC on \Device\Null), once per boot, before any sandboxed process starts.
+void cewrapper::grant_access_to_nul_device()
+{
+    // S-1-15-2-1 is ALL APPLICATION PACKAGES, S-1-15-2-2 is ALL RESTRICTED APPLICATION PACKAGES (LPAC)
+    PSID all_packages = nullptr;
+    PSID all_restricted_packages = nullptr;
+    cewrapper::CheckWin32(ConvertStringSidToSidW(L"S-1-15-2-1", &all_packages), L"ConvertStringSidToSidW(S-1-15-2-1)");
+    cewrapper::CheckWin32(ConvertStringSidToSidW(L"S-1-15-2-2", &all_restricted_packages),
+                          L"ConvertStringSidToSidW(S-1-15-2-2)");
+
+    EXPLICIT_ACCESSW access[2] = {};
+    for (auto &entry : access)
+    {
+        entry.grfAccessPermissions = GENERIC_READ | GENERIC_WRITE | GENERIC_EXECUTE;
+        entry.grfAccessMode = GRANT_ACCESS;
+        entry.grfInheritance = NO_INHERITANCE;
+        entry.Trustee.TrusteeForm = TRUSTEE_IS_SID;
+        entry.Trustee.TrusteeType = TRUSTEE_IS_GROUP;
+    }
+    access[0].Trustee.ptstrName = static_cast<wchar_t *>(all_packages);
+    access[1].Trustee.ptstrName = static_cast<wchar_t *>(all_restricted_packages);
+
+    HANDLE hnul = CreateFileW(L"\\\\.\\NUL", READ_CONTROL | WRITE_DAC,
+                              FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr, OPEN_EXISTING, 0,
+                              nullptr);
+    cewrapper::CheckWin32(hnul != INVALID_HANDLE_VALUE, L"CreateFileW(\\\\.\\NUL)");
+
+    DWORD sd_size = 0;
+    GetKernelObjectSecurity(hnul, DACL_SECURITY_INFORMATION, nullptr, 0, &sd_size);
+    std::vector<BYTE> sd_buffer(sd_size);
+    cewrapper::CheckWin32(GetKernelObjectSecurity(hnul, DACL_SECURITY_INFORMATION, sd_buffer.data(), sd_size, &sd_size),
+                          L"GetKernelObjectSecurity");
+
+    BOOL dacl_present = FALSE;
+    BOOL dacl_defaulted = FALSE;
+    ACL *prevAcl = nullptr;
+    cewrapper::CheckWin32(GetSecurityDescriptorDacl(sd_buffer.data(), &dacl_present, &prevAcl, &dacl_defaulted),
+                          L"GetSecurityDescriptorDacl");
+
+    // SetEntriesInAclW replaces any existing ACE for the same trustee, so re-running this is harmless
+    ACL *newAcl = nullptr;
+    cewrapper::CheckStatus(SetEntriesInAclW(2, access, dacl_present ? prevAcl : nullptr, &newAcl), L"SetEntriesInAclW");
+
+    SECURITY_DESCRIPTOR newSd = {};
+    cewrapper::CheckWin32(InitializeSecurityDescriptor(&newSd, SECURITY_DESCRIPTOR_REVISION),
+                          L"InitializeSecurityDescriptor");
+    cewrapper::CheckWin32(SetSecurityDescriptorDacl(&newSd, TRUE, newAcl, FALSE), L"SetSecurityDescriptorDacl");
+    cewrapper::CheckWin32(SetKernelObjectSecurity(hnul, DACL_SECURITY_INFORMATION, &newSd), L"SetKernelObjectSecurity");
+
+    LocalFree(newAcl);
+    LocalFree(all_packages);
+    LocalFree(all_restricted_packages);
+    CloseHandle(hnul);
+}
 
 void cewrapper::grant_access_to_path(wchar_t *container_sid, wchar_t *dir, uint32_t permissions)
 {

src/config.cpp

@@ -68,14 +68,29 @@ void cewrapper::Config::initFromArguments(int argc, wchar_t *argv[])
             this->wait_before_spawn = true;
             arg_idx++;
         }
+        else if (arg.compare(L"--prepare-nul") == 0)
+        {
+            this->prepare_nul = true;
+            arg_idx++;
+        }
         else
         {
             break;
         }
     }
 
-    this->progid = argv[arg_idx];
     this->args.clear();
+
+    // --prepare-nul is a standalone maintenance mode, everything else needs an executable to run
+    if (arg_idx >= argc)
+    {
+        if (this->prepare_nul)
+            return;
+
+        throw std::exception("No executable given");
+    }
+
+    this->progid = argv[arg_idx];
     arg_idx += 1;
     for (; arg_idx < argc; ++arg_idx)
         this->args.push_back(argv[arg_idx]);

src/main.cpp

@@ -216,6 +216,7 @@ int wmain(int argc, wchar_t *argv[])
         std::wcerr << L"Too few arguments\n";
         std::wcerr << L"Usage: cewrapper.exe [-v] [--config=/full/path/to/config.json] [--home=/preferred/cwdpath] "
                       L"[--time_limit=1] ExePath [args]\n";
+        std::wcerr << L"       cewrapper.exe --prepare-nul   (run elevated, once per boot)\n";
         return (DWORD)SpecialExitCode::NotEnoughArgs;
     }
 
@@ -231,6 +232,24 @@ int wmain(int argc, wchar_t *argv[])
         return (DWORD)SpecialExitCode::InvalidArgs;
     }
 
+    if (cewrapper::Config::get().prepare_nul)
+    {
+        try
+        {
+            cewrapper::grant_access_to_nul_device();
+        }
+        catch (std::exception &)
+        {
+            std::wcerr << L"Could not grant AppContainer access to the NUL device, is this running elevated?\n";
+            return (DWORD)SpecialExitCode::ErrorPreparingNulDevice;
+        }
+
+        if (cewrapper::Config::get().debugging)
+            std::wcerr << L"Granted app package access to the NUL device\n";
+
+        return 0;
+    }
+
     cewrapper::Job job(cewrapper::Config::get());
 
     DWORD app_exit_code = (DWORD)SpecialExitCode::ErrorWhenExecutingProcess;