File opening/creating with Nt/Zw APIs are ignored by sandbox

[rongjiecomputer]

Detoured Win32 APIs handle file opening/creating, but detoured Nt/Zw APIs seem to not handle it. Msys2/Cygwin C runtime implementation use Nt APIs instead of Win32 APIs to implement POSIX functions, which means programs linked to Msys2/Cygwin runtime are not constrained by the sandbox at all.

Any timeline that this can be fixed? I wonder if the change will look similar to how Detoured Win32 implementation? If the change is not too complicated, will the team accept external PR?

BuildXL/Public/Src/Sandbox/Windows/DetoursServices/DetouredFunctions.cpp

Line 5690 in 8621d3e

// TODO: As part of gradually turning on NtCreateFile detour reports, we currently only enforce deletes (some cmd builtins delete this way),

[narasamdya]

Yes, the team accepts external PR. Please include unit tests as well.