From 7860807f9eb95e349da03d7bfcbfea8b8dd183a3 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sat, 26 Sep 2026 08:14:35 +0000
Subject: [PATCH 1/2] Grant ALL APPLICATION PACKAGES read access on the app
 install root

Restricted-token sandbox processes (Chromium, Electron, CEF children) are
denied access to a directory whose ACL carries an AppContainer package ACE
but no ALL APPLICATION PACKAGES entry. Per-user installs under
%LocalAppData% can inherit the former from other software; Program Files
installs always have the latter. Add the same inheritable read/execute
grant on the app root at install time and at the start of an update.
---
 src/Update/Program.cs | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/src/Update/Program.cs b/src/Update/Program.cs
index 7bfc2b00f..22405a8df 100644
--- a/src/Update/Program.cs
+++ b/src/Update/Program.cs
@@ -9,6 +9,8 @@
 using System.IO.Compression;
 using System.Linq;
 using System.Reflection;
+using System.Security.AccessControl;
+using System.Security.Principal;
 using System.Text;
 using System.Text.RegularExpressions;
 using System.Threading;
@@ -175,6 +177,7 @@ await this.ErrorIfThrows(() => Utility.DeleteDirectory(mgr.RootAppDirectory),
                 }
 
                 Directory.CreateDirectory(mgr.RootAppDirectory);
+                grantAppPackagesReadAccess(mgr.RootAppDirectory);
 
                 var updateTarget = Path.Combine(mgr.RootAppDirectory, "Update.exe");
                 this.ErrorIfThrows(() => File.Copy(Assembly.GetExecutingAssembly().Location, updateTarget, true),
@@ -196,6 +199,7 @@ public async Task Update(string updateUrl, string appName = null)
             using (var mgr = new UpdateManager(updateUrl, appName)) {
                 bool ignoreDeltaUpdates = false;
                 this.Log().Info("About to update to: " + mgr.RootAppDirectory);
+                grantAppPackagesReadAccess(mgr.RootAppDirectory);
 
             retry:
                 try {
@@ -226,6 +230,27 @@ await this.ErrorIfThrows(() =>
             }
         }
 
+        // Restricted-token sandbox processes (Chromium/Electron/CEF children) are
+        // denied access to a directory whose ACL has an AppContainer package ACE but
+        // no ALL APPLICATION PACKAGES entry; %LocalAppData% installs can inherit the
+        // former from other software, Program Files installs always have the latter.
+        void grantAppPackagesReadAccess(string directory)
+        {
+            try {
+                var info = new DirectoryInfo(directory);
+                var security = info.GetAccessControl();
+                security.AddAccessRule(new FileSystemAccessRule(
+                    new SecurityIdentifier("S-1-15-2-1"),
+                    FileSystemRights.ReadAndExecute,
+                    InheritanceFlags.ContainerInherit | InheritanceFlags.ObjectInherit,
+                    PropagationFlags.None,
+                    AccessControlType.Allow));
+                info.SetAccessControl(security);
+            } catch (Exception ex) {
+                this.Log().WarnException("Couldn't grant ALL APPLICATION PACKAGES read access to " + directory, ex);
+            }
+        }
+
         public async Task UpdateSelf()
         {
             waitForParentToExit();

From ccc402a04ccb82701ce3b6b5a892a5f83b5dff72 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Sat, 26 Sep 2026 08:16:55 +0000
Subject: [PATCH 2/2] Only touch the ACL on update when running from an
 installed app root

---
 src/Update/Program.cs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/Update/Program.cs b/src/Update/Program.cs
index 22405a8df..1ff9b1b32 100644
--- a/src/Update/Program.cs
+++ b/src/Update/Program.cs
@@ -199,7 +199,9 @@ public async Task Update(string updateUrl, string appName = null)
             using (var mgr = new UpdateManager(updateUrl, appName)) {
                 bool ignoreDeltaUpdates = false;
                 this.Log().Info("About to update to: " + mgr.RootAppDirectory);
-                grantAppPackagesReadAccess(mgr.RootAppDirectory);
+                if (mgr.IsInstalledApp) {
+                    grantAppPackagesReadAccess(mgr.RootAppDirectory);
+                }
 
             retry:
                 try {