fix: disable Windows permission inheritance to resolve OSQuery extension loading issues

[marc-gr]

What does this PR do?

disable Windows permission inheritance

Why is it important?

It resolves OSQuery extension loading issues

Checklist

• I have read and understood the pull request guidelines of this project.
• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in ./changelog/fragments using the changelog tool
• I have added an integration test or an E2E test

Disruptive User Impact

How to test this PR locally

Related issues

• Relates Disable permission inheritance on Windows #7260
• Relates OSquery fails to run after upgrade from versions before v8.15.4 due to stricter extension permission checks #6792

[marc-gr]

not sure where we might want to backport this one @cmacknz

[mergify]

This pull request does not have a backport label. Could you fix it @marc-gr? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-./d./d is the label that automatically backports to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: ca5e1fb

Failed CI Steps

• Unit tests - Windows 2022
• Unit tests - Windows 2022
• Unit tests - Windows 2016
• Unit tests - Windows 2016
• Unit tests - Windows 10
• Unit tests - Windows 10
• Unit tests - Windows 11
• Unit tests - Windows 11
• Merge coverage reports
• Win2022:sudo:default
• Win2022:sudo:default
• Win2022:sudo:fleet
• Win2022:sudo:fleet
• Win2022:sudo:fleet-privileged
• Win2022:sudo:fleet-privileged
• Win2022:sudo:standalone-upgrade
• Win2022:sudo:standalone-upgrade
• Win2022:sudo:upgrade
• Win2022:sudo:upgrade
• Win2022:sudo:upgrade-flavor
• Win2022:sudo:upgrade-flavor
• Win2025:sudo:default
• Win2025:sudo:default
• Win2025:sudo:fleet
• Win2025:sudo:fleet
• Win2025:sudo:standalone-upgrade
• Win2025:sudo:standalone-upgrade
• Win2025:sudo:upgrade
• Win2025:sudo:upgrade
• Win2025:sudo:upgrade-flavor
• Win2025:sudo:upgrade-flavor
• x86_64:sudo: upgrade
• x86_64:sudo: upgrade
• x86_64:sudo: fleet
• x86_64:sudo: fleet-airgapped
• x86_64:sudo: fleet-airgapped-privileged
• x86_64:sudo: fleet-airgapped-privileged
• x86_64:sudo: fleet-privileged
• x86_64:sudo: fleet-privileged
• arm:sudo: upgrade
• arm:sudo: fleet
• x86_64:sudo: upgrade
• x86_64:sudo: fleet
• x86_64:sudo: fleet-airgapped
• x86_64:sudo: fleet-airgapped
• x86_64:sudo: fleet-airgapped-privileged
• x86_64:sudo: fleet-airgapped-privileged
• x86_64:sudo: fleet-privileged
• x86_64:sudo: fleet-privileged
• Windows:2022:amd64:sudo
• Windows:2022:amd64:sudo
• Windows:2025:amd64:sudo
• Windows:2025:amd64:sudo

History

cc @marc-gr

[blakerouse]

This still has the issue of not working. If a user goes all the way into the components directory (Windows will update the permissions of that directory), it will still fail to run. This is only reducing the chance that it happens and not actually fixing the issue.

[elastic-sonarqube]

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 40%)

See analysis details on SonarQube

[marc-gr]

This still has the issue of not working. If a user goes all the way into the components directory (Windows will update the permissions of that directory), it will still fail to run. This is only reducing the chance that it happens and not actually fixing the issue.

as discussed I'll close this one and implement this on osquerybeat instead