Description

In the Windows file permission auditing mechanism (src/security/windows-acl.ts), the classifyPrincipal function categorizes Windows ACL entries into trusted, world, or group.

Currently, WORLD_PRINCIPALS and WORLD_SIDS strictly cover Everyone (S-1-1-0), Authenticated Users (S-1-5-11), and Users (S-1-5-32-545).

However, it omits several critical Well-Known SIDs that represent unauthenticated or extremely broad access. If a sensitive file (e.g., config, credentials, or agent harnesses) grants write access to Anonymous Logon or Guests, classifyPrincipal falls through the WORLD_* checks and mistakenly categorizes them as just group.

Consequently, in src/security/audit-fs.ts:

worldWritable: acl.untrustedWorld.some((entry) => entry.canWrite), // Evaluates to FALSE
groupWritable: acl.untrustedGroup.some((entry) => entry.canWrite), // Evaluates to TRUE

This causes worldWritable to return false for files that are practically writable by anyone (including entirely unauthenticated actors), potentially bypassing strict worldWritable audit guards during OpenClaw's security scans.

Missing Critical SIDs / Principals

The following should be considered "world" equivalent to prevent audit bypasses:

• S-1-5-7 / anonymous logon (Any user connected without supplying credentials)
• S-1-5-32-546 / builtin\guests, guests (Guest privileges)
• S-1-5-4 / interactive (Any user logging on locally)
• S-1-2-0 / local (Local Terminal Users)
• S-1-5-2 / network (Network Logon Users)

Steps to Reproduce

1. Create a sensitive file in a Windows environment where OpenClaw runs.
2. Use icacls to grant Full Control exclusively to Anonymous Logon (S-1-5-7).
3. Run OpenClaw's security scanner (inspectPathPermissions / safeStat).
4. Observation: The audit returns worldWritable: false and groupWritable: true.
5. Expected: It should return worldWritable: true due to the unauthenticated nature of the principal.

Proposed Fix

Append the missing unauthenticated/broad-access SIDs and string constants to WORLD_SIDS and WORLD_PRINCIPALS in src/security/windows-acl.ts:

const WORLD_SIDS = new Set([
  "s-1-1-0",        // Everyone
  "s-1-5-11",       // Authenticated Users
  "s-1-5-32-545",   // BUILTIN\Users
  "s-1-5-7",        // Anonymous Logon
  "s-1-5-32-546",   // BUILTIN\Guests
  "s-1-5-4",        // Interactive
  "s-1-2-0",        // Local
  "s-1-5-2"         // Network
]);

const WORLD_PRINCIPALS = new Set([
  "everyone",
  "users",
  "builtin\\users",
  "authenticated users",
  "nt authority\\authenticated users",
  "anonymous logon",
  "nt authority\\anonymous logon",
  "guests",
  "builtin\\guests",
  "interactive",
  "nt authority\\interactive",
  "network",
  "nt authority\\network",
  "local"
]);