[1.8-stable] Gated port: MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY child-process isolation (#5987)#6631
Merged
Conversation
…hild-process isolation (#5987) Ports the base-directory PID-guard fix (main #6619) into release/1.8-stable, gated behind a runtime-compatibility containment change (WINAPPSDK_CHANGEID_63098344) so apps can revert. MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY is set by the Windows App SDK auto-initializer (a requirement for PublishSingleFile SxS manifest redirection). Because it is a process environment variable it is inherited by child processes spawned via CreateProcess, so a child's MRTCore resolved the parent's resources.pri and reg-free WinRT redirection could be steered by a parent-controlled directory. The setter now also stamps MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY_PID with the owning process id. Gated behind WINAPPSDK_CHANGEID_63098344 (2-arg ContainmentV1 form, target WinAppSDK_1_8_11): - Enabled (default): MRM.cpp and catalog.cpp honor the base directory only when the stamp matches the current process; inherited (foreign) values fall back to the module directory. - Disabled (via RuntimeCompatibilityOptions): the base directory is honored regardless of the stamp (byte-for-byte prior behavior). Changes: - UndockedRegFreeWinRT-AutoInitializer.cs: stamp the owning process id (ungated; consumers ignore it when the change is disabled). - MRM.cpp: add WINAPPSDK_CHANGEID_63098344 and gate the base-directory PID guard. - catalog.cpp: gate the %MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY% strip on the change (WindowsAppRuntime_DLL already links the FrameworkUdk containment worker). - MrmTests.cpp: EnvironmentVariableIsolationTests (enabled: in-process guard + real cross-process insulation) and BaseDirectoryContainmentDisabledTest (IsolationLevel=Method; disables 63098344 and verifies the inherited base directory is honored). Verified locally (x64 Debug): MrmUnitTest 25/26 (1 skipped child-only worker), both enabled and disabled cases. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: dac4165f-ec13-4406-9206-60cd55b24c2b
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
agniuks
previously approved these changes
Jul 17, 2026
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). 2 pipeline(s) were filtered out due to trigger conditions. |
…ent (#5987) RCA of a PR-validation regression in CompatibilityTests (CanSetRuntimeCompatibilityOptions and VerifyDisabledChanges failing intermittently with E_ILLEGAL_STATE_CHANGE, "Configuration already set or locked"): WinAppSdk::Containment::IsChangeEnabled<>() locks the process's runtime-compatibility configuration on first call. catalog.cpp's WinRTLoadComponentFromString runs during reg-free WinRT activation - before an app (or test) can call RuntimeCompatibilityOptions.Apply(). Calling IsChangeEnabled unconditionally there locked the configuration early, so a subsequent Apply() failed. The manifest only references %MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY% for PublishSingleFile apps, so only consult the containment change when that token is actually present. Non-single-file activation (the common case, including CompatibilityTests) no longer calls IsChangeEnabled and no longer locks the configuration. MRTCore MrmUnitTest is unaffected (catalog.cpp is not in that binary). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: dac4165f-ec13-4406-9206-60cd55b24c2b
Member
Author
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). 2 pipeline(s) were filtered out due to trigger conditions. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Servicing port of #6619 (main) into
release/1.8-stable, gated behind a runtime-compatibility containment change so apps can revert.Problem
MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORYis set by the Windows App SDK auto-initializer (a requirement for PublishSingleFile SxS manifest redirection). As a process environment variable it is inherited byCreateProcesschildren, so a child's MRTCore resolved the parent'sresources.pri, and reg-free WinRT redirection could be steered by a parent-controlled directory.Fix (gated on
WINAPPSDK_CHANGEID_63098344)The setter now also stamps
MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY_PIDwith the owning process id. 1.8 uses the ContainmentV1 model, so the change ID bakes in the target patch version:#define WINAPPSDK_CHANGEID_63098344 63098344, WinAppSDK_1_8_11.MRM.cppandcatalog.cpphonor the base directory only when the stamp matches the current process; inherited (foreign) values fall back to the module directory.RuntimeCompatibilityOptions): the base directory is honored regardless of the stamp — byte-for-byte prior behavior.Changes
UndockedRegFreeWinRT-AutoInitializer.cs— stamp the owning process id (ungated; consumers ignore it when the change is disabled).MRM.cpp— addWINAPPSDK_CHANGEID_63098344+ gate the base-directory PID guard.catalog.cpp— gate the%MICROSOFT_WINDOWSAPPRUNTIME_BASE_DIRECTORY%strip on the change (WindowsAppRuntime_DLL already links the FrameworkUdk containment worker).MrmTests.cpp—EnvironmentVariableIsolationTests(enabled: in-process guard + real cross-process insulation) andBaseDirectoryContainmentDisabledTest(IsolationLevel=Method; disables 63098344 and verifies the inherited base directory is honored).The base-directory naming refactor from #6619 is intentionally not ported (servicing = minimal change); the setter stays in
UndockedRegFreeWinRT-AutoInitializer.cs.Validation
Local (VS x64 Debug):
MRM.vcxproj+MrmUnitTest.vcxprojbuild clean;MrmUnitTest25/26 (1 skipped child-only worker), covering both enabled and disabled states;catalog.cppadditions syntax-checked (cl /W4).