#54382: fix: report install folders that the sandbox cannot read on Windows instead of crash-looping the GPU process
Description of Change
Refs #51761.
After this change an app whose Windows install folder ACL has a stray AppContainer entry stops at startup with an error that names the folder and the icacls command that fixes it, instead of a GPU process crash loop ending in "GPU process isn't usable. Goodbye." The ACL itself is left to installers.
Sandboxed children run with a restricted token, and Windows checks a restricted token against a DACL containing any AppContainer package SID (S-1-15-2-*) as if it were an AppContainer: only ALL APPLICATION PACKAGES or ALL RESTRICTED APPLICATION PACKAGES can grant. Per-user install folders under %LOCALAPPDATA% (Squirrel.Windows, per-user NSIS) inherit package ACEs left by other software and carry neither, so every sandboxed child was denied its own install directory and died opening icudtl.dat, GPU process first. Program Files installs inherit ALL APPLICATION PACKAGES read access, which is why Chrome never sees this. Confirmed on a Windows 11 VM with stock 44.4.3: one S-1-15-2-<n> ACE on the folder reproduces the crash loop, auditing shows the children's icudtl.dat opens failing in the restricted-SID pass, and granting either well-known package group fixes it.
Before the first sandboxed child launches, the browser now builds the sandbox's initial restricted token and runs AccessCheck() for icudtl.dat against it (nothing impersonates the token). If that is denied it aborts with a FATAL log naming the directory and icacls "<dir>" /grant *S-1-15-2-1:(OI)(CI)(RX). The AccessCheck() probe was verified on the same VM in both UAC configurations (an earlier revision of this branch that granted the ACE at runtime started normally where 44.4.3 crash-looped); the abort message itself is a log-only change on top of that. Installer-side ACL setup for Squirrel.Windows and electron-builder is tracked from the issue.
Checklist
- I have built and tested this change
- I have filled out the PR description
- I have reviewed and verified the changes
Release Notes
Notes: Fixed the GPU process crash-looping on Windows when the sandbox cannot read the install folder; the folder is now reported instead.
Backports
Semver Impact
Semantic Versioning helps users understand the impact of updates:
- Major (X.y.z): Breaking changes that may require code modifications
- Minor (x.Y.z): New features that maintain backward compatibility
- Patch (x.y.Z): Bug fixes that don't change the API
- None: Changes that don't affect using facing parts of Electron