From 319fc9fd2dec7ff71bdef40f5e9e6857f292a65f Mon Sep 17 00:00:00 2001 From: Alexey Grigorev Date: Fri, 6 Nov 2026 10:25:31 +0100 Subject: [PATCH] Apply credential ACLs without Windows audit privileges --- src/dapier/private_files.py | 2 +- tests/test_private_files.py | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/dapier/private_files.py b/src/dapier/private_files.py index 128cabd..008563d 100644 --- a/src/dapier/private_files.py +++ b/src/dapier/private_files.py @@ -32,7 +32,7 @@ def protect(path): $acl.SetAccessRuleProtection($true, $false) $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'Allow') $acl.AddAccessRule($rule) - Set-Acl -LiteralPath $env:DAPIER_PRIVATE_PATH -AclObject $acl + [System.IO.File]::SetAccessControl($env:DAPIER_PRIVATE_PATH, $acl) """) diff --git a/tests/test_private_files.py b/tests/test_private_files.py index 9b49e43..43eb1fc 100644 --- a/tests/test_private_files.py +++ b/tests/test_private_files.py @@ -10,6 +10,8 @@ def test_protected_token_is_private(tmp_path): path = tmp_path / "token with spaces.txt" path.write_text("secret") protect(path) + # Reapplying protection must not request the Windows audit privilege. + protect(path) require_private(path) assert path.read_text() == "secret"