From c39d3338e534737b2f62034071da3604932d8379 Mon Sep 17 00:00:00 2001 From: kuddev Date: Mon, 14 Sep 2026 21:48:52 +0800 Subject: [PATCH] test(windows): exercise process containment after privilege reduction --- .github/workflows/windows-conformance.yml | 3 +++ scripts/conformance/harness.py | 6 +++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/windows-conformance.yml b/.github/workflows/windows-conformance.yml index db58fe6..f8c2aed 100644 --- a/.github/workflows/windows-conformance.yml +++ b/.github/workflows/windows-conformance.yml @@ -38,6 +38,9 @@ jobs: run: | Get-Acl diagnostic-runtime/pebrel.exe | Format-List Get-Acl $env:pythonLocation/python.exe | Format-List + - name: Test containment with an ordinary token + if: always() + run: python scripts/conformance/windows_standard_user.py -m unittest scripts.conformance.tests.test_lifecycle -v - name: Diagnose the previously built runtime if: always() shell: pwsh diff --git a/scripts/conformance/harness.py b/scripts/conformance/harness.py index d6b0180..92da174 100644 --- a/scripts/conformance/harness.py +++ b/scripts/conformance/harness.py @@ -337,13 +337,13 @@ class _WindowsJob: self._process_handles: list[int] = [] self._handle = self._api.CreateJobObjectW(None, None) if not self._handle: - raise ctypes.WinError(ctypes.get_last_error()) + raise ctypes.WinError(ctypes.get_last_error(), "CreateJobObjectW failed") limits = ExtendedLimits() limits.BasicLimitInformation.LimitFlags = 0x2000 # KILL_ON_JOB_CLOSE if not self._api.SetInformationJobObject( self._handle, 9, ctypes.byref(limits), ctypes.sizeof(limits) ): - error = ctypes.WinError(ctypes.get_last_error()) + error = ctypes.WinError(ctypes.get_last_error(), "SetInformationJobObject failed") self.close() raise error @@ -351,7 +351,7 @@ class _WindowsJob: # CPython retains the native process handle on Windows. Using that # handle avoids opening a PID that could have been recycled. if not self._api.AssignProcessToJobObject(self._handle, int(process._handle)): - raise ctypes.WinError(ctypes.get_last_error()) + raise ctypes.WinError(ctypes.get_last_error(), "AssignProcessToJobObject failed") def terminate(self, timeout: float = 5.0) -> None: deadline = time.monotonic() + timeout