[Bug]: `PartialTrustApplication` and `isolatedWin32-* Capabilities` can't be declared in one package

[AndromedaMelody]

Version

Windows: 10.0.25370.1

Repro Steps

According to AppxManifest Document and microsoft/WindowsAppSDK#219 :

1. Add EntryPoint="windows.partialTrustApplication" or uap10:RuntimeBehavior="packagedClassicApp" uap10:TrustLevel="appContainer" in <Application>; Add uap10:TrustLevel="appContainer" previewsecurity2:RuntimeBehavior="appSilo" in <Application>.
2. Add isolatedWin32-* in <Capabilities>.
3. Register the package and run.

Unexpected Results

The application(PartialTrust) can't start, and the application(AppSilo) start properly.

Are there any relation between PartialTrust and AppSilo?

[lilybarkley-msft]

I will update the documentation to reflect this, but isolated win32 apps aren't compatible with other application types within the same package

[MouriNaruto]

@lilybarkley-msft

but isolated win32 apps aren't compatible with other application types within the same package

In my opinion, some components in a package may not need the extra attacking surface provided by the App Silo. So, it's necessary for support both App Silo and Partial Trust in one app package.

Even I hope we can run something as the pure App Container (even the Low Privileged App Container which used in Chromium-based web browsers) or Partial Trust in an app which run as App Silo for continually improving the security and privacy.

Kenji Mouri

[lilybarkley-msft]

In my opinion, some components in a package may not need the extra attacking surface provided by the App Silo. So, it's necessary for support both App Silo and Partial Trust in one app package.

This is a good point, I'll have a discussion about this with the rest of the team