move POSIX spawn, exec and child tracking into posixsrv, keep process transactions alive across reconnects and preserve stable PIDs across image replacement, flesh out spawn with ordered file actions, process-group selection and signal inheritance, implement execve with bootstrap validation and rollback before retiring the old process, add vfork children that share the native process while keeping separate POSIX descriptor and signal state, replace local spawn bookkeeping with child reaping, nonblocking and process-group waits and orphan cleanup, add signal dispositions, per-thread masks, pending delivery, process/group signalling and alarms, translate native exceptions into POSIX signals and inherit masks when creating threads, make pipe waits interruptible and raise SIGPIPE for broken pipes, pass arguments and environment into main and add getenv/environ, add direct user APC notifications that can run without an alertable wait, add current-thread capabilities and resume-and-wait, let accepted IPC endpoints open restricted peer process capabilities and preserve caller security during spawn and exec, make process preparation reusable and improve DLL lookup across current, executable and fallback directories, move keyboard repeat into RSSRV so PS/2 and USB share one repeat policy, fix video presentation, report launch failure stages and status codes, mooaaar tests.

code/user/tests/security_smoke/security_smoke.c

@@ -169,6 +169,10 @@ static int run_restricted_child(uint32_t parentPid) {
     status = SysCloseHandle(process);
     if (!KSUCCESS(status)) return 28;
 
+    process = SYS_HANDLE_INVALID;
+    status = SysOpenProcess(selfPid, SYS_RIGHT_QUERY | SYS_PROCESS_RIGHT_SECURITY_CONTEXT, &process);
+    if (status != NTLSTATUS_ACCESS_DENIED) return 29;
+
     return 0;
 }
 
@@ -203,6 +207,38 @@ static int run_parent(void) {
         rootInfo.DelegableServiceClaims != SYS_SERVICE_CLAIM_ALL)
         fail_status("bootstrap context authority", NTLSTATUS_FAILURE);
 
+    SYS_HANDLE selfProcess = SYS_HANDLE_INVALID;
+    status = SysOpenProcess(SysGetCurrentPid(),
+                            SYS_RIGHT_QUERY | SYS_PROCESS_RIGHT_SECURITY_CONTEXT,
+                            &selfProcess);
+    if (!KSUCCESS(status)) fail_status("open self security-context process", status);
+    SYS_HANDLE exactContext = SYS_HANDLE_INVALID;
+    status = SysOpenProcessSecurityContext(
+        selfProcess, SYS_RIGHT_QUERY | SYS_SECURITY_CONTEXT_RIGHT_ASSIGN, &exactContext);
+    if (!KSUCCESS(status)) fail_status("open exact process security context", status);
+    SYS_SECURITY_CONTEXT_INFO exactInfo;
+    memset(&exactInfo, 0, sizeof(exactInfo));
+    exactInfo.Size = sizeof(exactInfo);
+    status = SysQuerySecurityContext(exactContext, &exactInfo);
+    if (!KSUCCESS(status)) fail_status("query exact process security context", status);
+    if (exactInfo.SecurityId != rootInfo.SecurityId ||
+        exactInfo.EffectivePrivileges != rootInfo.EffectivePrivileges ||
+        exactInfo.DelegablePrivileges != rootInfo.DelegablePrivileges ||
+        exactInfo.ServiceClaims != rootInfo.ServiceClaims ||
+        exactInfo.DelegableServiceClaims != rootInfo.DelegableServiceClaims)
+        fail_status("exact process security context identity", NTLSTATUS_FAILURE);
+    (void)SysCloseHandle(exactContext);
+    (void)SysCloseHandle(selfProcess);
+
+    SYS_HANDLE queryOnlyProcess = SYS_HANDLE_INVALID;
+    status = SysOpenProcess(SysGetCurrentPid(), SYS_RIGHT_QUERY, &queryOnlyProcess);
+    if (!KSUCCESS(status)) fail_status("open query-only self process", status);
+    exactContext = SYS_HANDLE_INVALID;
+    status = SysOpenProcessSecurityContext(queryOnlyProcess, SYS_RIGHT_QUERY, &exactContext);
+    (void)SysCloseHandle(queryOnlyProcess);
+    if (status != NTLSTATUS_ACCESS_DENIED)
+        fail_status("process security-context right", status);
+
     SYS_HANDLE restricted = derive_stripped_context();
     SYS_SECURITY_CONTEXT_INFO restrictedInfo;
     memset(&restrictedInfo, 0, sizeof(restrictedInfo));