gh-134587: Suggest fix for tempfile.mkdtemp() in Windows AppContainer

[vedant713]

---

Proposed Solution

• Detect whether the process is running inside an AppContainer.
• Retrieve the AppContainer SID using whoami /user.
• Use icacls to grant Full Control access to that SID for the created directory.

---

Suggested Helper Functions

if_os.name=='nt':
importctypesas_ctypesimportctypes.wintypesas_wintypesimportsubprocessas_subprocessdef_is_appcontainer():
TOKEN_QUERY=0x0008TokenIsAppContainer=29h_token=_wintypes.HANDLE()
ifnot_ctypes.windll.advapi32.OpenProcessToken(
_ctypes.windll.kernel32.GetCurrentProcess(),
TOKEN_QUERY,
_ctypes.byref(h_token)
):
returnFalseis_container=_wintypes.BOOL()
return_length=_wintypes.DWORD()
ifnot_ctypes.windll.advapi32.GetTokenInformation(
h_token,
TokenIsAppContainer,
_ctypes.byref(is_container),
_ctypes.sizeof(is_container),
_ctypes.byref(return_length)
):
returnFalsereturnbool(is_container.value)
def_grant_appcontainer_access(path):
try:
sid=_subprocess.check_output("whoami /user", shell=True)
sid_str=sid.decode().splitlines()[1].split()[1]
_subprocess.run(f'icacls \"{path}\" /grant *{sid_str}:(OI)(CI)F', shell=True, check=True)
exceptException:
pass

• Issue: mkdtemp() created directories no longer allows for writing files when running under a Windows AppContainer in 3.12.4 (but works under 3.12.3) #134587

[github-actions]

This PR is stale because it has been open for 30 days with no activity.