Preserve token owner during distribution move rollback

[Ben Hillis (benhillis)]

Summary of the Pull Request

Preserves the source VHD's owner when rolling back a distribution move.

PR Checklist

• Closes: Link to issue #xxx
• Communication: I've discussed this with core contributors already. If work hasn't been agreed, this work might be rejected
• Tests: Added/updated if needed and all pass
• Localization: All end user facing strings can be localized
• Dev docs: Added/updated if needed
• Documentation updated: If checked, please file a pull request on our docs repo and link it here: #xxx

Detailed Description of the Pull Request / Additional comments

Follow-up to #41333. Before moving the VHD, capture its current owner SID under caller impersonation. If the operation must be rolled back, use that SID as the duplicated token's default owner before the reverse MoveFileExW operation.

This keeps the normal forward move owned by the caller's user SID while ensuring a cross-volume rollback recreates the VHD with its pre-move owner.

Validation Steps Performed

• FormatSource.ps1
• cmake --build . -- -m
• bin\x64\Debug\test.bat -f /name:*MoveVhd* was attempted; shared module setup failed while setting the default test_distro, before either selected test executed.

[Copilot]

Pull request overview

This PR updates WSL’s Windows service distribution-move flow to preserve the duplicated caller token’s original default owner (TokenOwner) specifically for rollback scenarios, so cross-volume rollback copies keep the prior default-owner behavior while forward moves still normalize ownership to the caller’s user SID.

Changes:

• Capture the duplicated caller token’s original TOKEN_OWNER before normalizing it to the caller’s user SID.
• Restore the original token owner inside the rollback (scope_exit_log) path before executing the reverse MoveFileExW.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/windows/service/exe/LxssUserSession.cpp:980

• Rollback restores TokenOwner using originalVhdOwner unconditionally. If owner capture fails (or returns a null owner SID), this passes an invalid SID to SetTokenInformation and can also obscure the intended behavior. Guard the restore on originalVhdOwner being non-null.

    auto revert = wil::scope_exit_log(WI_DIAGNOSTICS_INFO, [&]() {
        TOKEN_OWNER originalOwner{originalVhdOwner};
        LOG_IF_WIN32_BOOL_FALSE(SetTokenInformation(userToken.get(), TokenOwner, &originalOwner, sizeof(originalOwner)));

src/windows/service/exe/LxssUserSession.cpp:958

• GetNamedSecurityInfoW failure now aborts MoveDistribution (THROW_IF_WIN32_ERROR). That can turn an otherwise-successful move into a hard failure if the caller lacks READ_CONTROL or the security query otherwise fails. Consider making the owner capture best-effort (log and continue), since it’s only needed to improve rollback fidelity.

This issue also appears on line 977 of the same file.

    {
        auto impersonate = wil::impersonate_token(userToken.get());
        THROW_IF_WIN32_ERROR(GetNamedSecurityInfoW(
            distro.VhdFilePath.c_str(), SE_FILE_OBJECT, OWNER_SECURITY_INFORMATION, &originalVhdOwner, nullptr, nullptr, nullptr, &originalSecurityDescriptor));
    }