From: Max Vilimpoc <max@vilimpoc.org>
Date: Sat, 29 Aug 2026 17:30:32 +0000 (+0200)
Subject: dotfiles: give the kernel logger's own ACL to Performance Log Users
X-Git-Url: https://vilimpoc.org/repos/dotfiles/commitdiff_plain/0aec6243fab52a10889bd5052a4cf1496be80b0d?ds=sidebyside;hp=0aec6243fab52a10889bd5052a4cf1496be80b0d

dotfiles: give the kernel logger's own ACL to Performance Log Users

The group membership and SeSystemProfilePrivilege were necessary and not
sufficient.  Measured on this box after signing in with both in place:

    xperf -start X -on Microsoft-Windows-Kernel-Process   -> exit 0, trace written
    xperf -on base                                        -> NT Kernel Logger:
                                                             Access is denied. (0x5)
    wpr -start GeneralProfile                             -> 0x80070005

The user-mode session proves the group fixed session control, and wpr's error
moving off "Failed to enable the policy to profile system performance" proves
the privilege took.  What is left is the kernel logger itself: it does not use
ETW's default per-GUID descriptor, and the explicit one on
SystemTraceControlGuid does not mention Performance Log Users.
EventAccessQuery on that GUID returns access denied outright from the account,
which is the tell.

So add an ACE for the group with EventAccessControl (EventSecurityAddDACL, so
the entries Windows relies on stay put), carrying the controller rights
including TRACELOG_ACCESS_KERNEL_LOGGER -- the right that names this particular
session.  It goes to the group like the privilege does, keeping membership the
single switch, and the log now records the resulting DACL.

The step moves to the FRONT of the elevated script and gains -EtwRightsOnly,
which runs it and exits.  It is seconds of LSA and registry work, where a full
run is dominated by three Visual Studio passes that take minutes with nothing to
do -- and iterating on this needed a way to apply it without paying for those.
`exit` inside the try still runs the finally, so the transcript is stopped and
the log left readable by the non-elevated caller.

The README now states the cost plainly: a member of that group can capture
system-wide kernel traces, including paths and command lines from every account
on the box.

Exercised under Windows PowerShell 5.1: the script parses, the EtwAcl interop
compiles, the rights mask reads 0x0FE1, and both EventAccessControl and
EventAccessQuery return a clean "access denied" from a non-elevated shell rather
than marshalling garbage.  The grant itself still needs an elevated run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YMh8i2QzkHNdE3MkKfcaT6
---