[2.0-stable] Gated port: MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY child-process isolation (#5987)#6632
Open
Scottj1s wants to merge 1 commit into
Open
[2.0-stable] Gated port: MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY child-process isolation (#5987)#6632Scottj1s wants to merge 1 commit into
Scottj1s wants to merge 1 commit into
Conversation
…hild-process isolation (#5987) Ports the base-directory PID-guard fix (main #6619) into release/2.0-stable, gated behind a runtime-compatibility containment change (WINAPPSDK_CHANGEID_63098302) so apps can revert. MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY is set by the Windows App SDK auto-initializer (a requirement for PublishSingleFile SxS manifest redirection). Because it is a process environment variable it is inherited by child processes spawned via CreateProcess, so a child's MRTCore resolved the parent's resources.pri and reg-free WinRT redirection could be steered by a parent-controlled directory. The setter now also stamps MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY_PID with the owning process id. Gated behind WINAPPSDK_CHANGEID_63098302 (ContainmentV2 form): - Enabled (default): MRM.cpp and catalog.cpp honor the base directory only when the stamp matches the current process; inherited (foreign) values fall back to the module directory. - Disabled (via RuntimeCompatibilityOptions): the base directory is honored regardless of the stamp (byte-for-byte prior behavior). Changes: - UndockedRegFreeWinRT-AutoInitializer.cs: stamp the owning process id (ungated; consumers ignore it when the change is disabled). - MRM.cpp: add WINAPPSDK_CHANGEID_63098302 and gate the base-directory PID guard. - catalog.cpp: gate the %MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY% strip on the change (WindowsAppRuntime_DLL already links the FrameworkUdk containment worker). - MrmTests.cpp: EnvironmentVariableIsolationTests (enabled: in-process guard + real cross-process insulation) and BaseDirectoryContainmentDisabledTest (IsolationLevel=Method; disables 63098302 and verifies the inherited base directory is honored). Verified locally (x64 Debug): MrmUnitTest 25/26 (1 skipped child-only worker), both enabled and disabled cases. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: dac4165f-ec13-4406-9206-60cd55b24c2b
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
agniuks
approved these changes
Jul 17, 2026
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). 2 pipeline(s) were filtered out due to trigger conditions. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Servicing port of #6619 (main) into
release/2.0-stable, gated behind a runtime-compatibility containment change so apps can revert.Problem
MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORYis set by the Windows App SDK auto-initializer (a requirement for PublishSingleFile SxS manifest redirection). As a process environment variable it is inherited byCreateProcesschildren, so a child's MRTCore resolved the parent'sresources.pri, and reg-free WinRT redirection could be steered by a parent-controlled directory.Fix (gated on
WINAPPSDK_CHANGEID_63098302)The setter now also stamps
MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY_PIDwith the owning process id. 2.0 uses the ContainmentV2 model:#define WINAPPSDK_CHANGEID_63098302 63098302.MRM.cppandcatalog.cpphonor the base directory only when the stamp matches the current process; inherited (foreign) values fall back to the module directory.RuntimeCompatibilityOptions): the base directory is honored regardless of the stamp — byte-for-byte prior behavior.Changes
UndockedRegFreeWinRT-AutoInitializer.cs— stamp the owning process id (ungated; consumers ignore it when the change is disabled).MRM.cpp— addWINAPPSDK_CHANGEID_63098302+ gate the base-directory PID guard.catalog.cpp— gate the%MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY%strip on the change (WindowsAppRuntime_DLL already links the FrameworkUdk containment worker).MrmTests.cpp—EnvironmentVariableIsolationTests(enabled: in-process guard + real cross-process insulation) andBaseDirectoryContainmentDisabledTest(IsolationLevel=Method; disables 63098302 and verifies the inherited base directory is honored).The base-directory naming refactor from #6619 is intentionally not ported (servicing = minimal change); the setter stays in
UndockedRegFreeWinRT-AutoInitializer.cs.Validation
Local (VS x64 Debug):
MRM.vcxproj+MrmUnitTest.vcxprojbuild clean;MrmUnitTest25/26 (1 skipped child-only worker), covering both enabled and disabled states.Companion 1.8 servicing PR: #6631.