ci: probe the Windows runner's ProgramData permissions

Author: txp666

.github/probe/probe.ps1

@@ -0,0 +1,35 @@
+$ErrorActionPreference = 'Stop'
+function Assert-ProtectedLocation([string]$path) {
+    $trusted = @('S-1-5-18', 'S-1-5-32-544', 'S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464', 'S-1-3-0')
+    # Delete, DeleteSubdirectoriesAndFiles, ChangePermissions, TakeOwnership and GENERIC_ALL.
+    $unsafe = 0x100D0040
+    $directory = Get-Item -LiteralPath $path -Force
+    while ($directory) {
+        if ($directory -isnot [System.IO.DirectoryInfo] -or ($directory.Attributes -band [System.IO.FileAttributes]::ReparsePoint)) {
+            throw ('Not a protected location: ' + $directory.FullName)
+        }
+        $acl = Get-Acl -LiteralPath $directory.FullName
+        $owner = $acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+        $open = @($acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]) | Where-Object {
+            $_.AccessControlType -eq 'Allow' -and $trusted -notcontains $_.IdentityReference.Value -and
+            !($_.PropagationFlags -band [System.Security.AccessControl.PropagationFlags]::InheritOnly) -and
+            ([int64]$_.FileSystemRights -band $unsafe)
+        })
+        if ($trusted -notcontains $owner -or $open.Count -gt 0) { throw ('Not a protected location: ' + $directory.FullName) }
+        $directory = $directory.Parent
+    }
+}
+
+whoami
+"elevated: " + ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+"default owner: " + [System.Security.Principal.WindowsIdentity]::GetCurrent().Owner.Value
+"known folder: " + [Environment]::GetFolderPath('CommonApplicationData')
+foreach ($path in @('C:\', 'C:\ProgramData')) {
+    $item = Get-Item -LiteralPath $path -Force
+    $acl = Get-Acl -LiteralPath $path
+    "== $path attributes=$($item.Attributes) owner=$($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value) protected=$($acl.AreAccessRulesProtected)"
+    foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+        '{0} {1} 0x{2:x} inherit={3} propagate={4}' -f $rule.IdentityReference.Value, $rule.AccessControlType, [int64]$rule.FileSystemRights, $rule.InheritanceFlags, $rule.PropagationFlags
+    }
+}
+try { Assert-ProtectedLocation 'C:\ProgramData'; 'CHECK OK C:\ProgramData' } catch { "CHECK REFUSED: $_" }

.github/workflows/probe.yml

@@ -0,0 +1,17 @@
+name: Probe
+
+on:
+  push:
+    branches: [ci-probe]
+
+permissions:
+  contents: read
+
+jobs:
+  probe:
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@v6
+      - name: Permissions of the updater's location
+        shell: powershell
+        run: .github/probe/probe.ps1