PSEC: volume root of a granted path can't be opened for attributes #1461

Relevant area(s)

Windows

Brief description of your issue

BFS allows opening ancestors of granted paths for SYNCHRONIZE | FILE_READ_ATTRIBUTES, but not the volume root directory. So CreateFileW("D:\", FILE_READ_ATTRIBUTES, …), GetFileInformationByName("D:\", …) and GetVolumeInformationW("D:\") fail, even though the same opens and queries succeed on D:\dir.

Steps to reproduce

1. Create a PSEC security environment that grants fs_read_only = ["D:\dir\dir2"].
2. Launch a process in the security environment that calls the three functions above on D:\ and D:\dir.

Expected behavior

The volume root behaves like any other ancestor of a grant (can be opened for SYNCHRONIZE | FILE_READ_ATTRIBUTES).

Actual behavior

All three calls fail on D:\ with ERROR_ACCESS_DENIED and succeed on D:\dir.

This breaks common programs. For example, cmd /d /c dir prints Access is denied., even in a granted writable directory, since cmd calls GetVolumeInformationW on the volume root.

Windows 10.0.26300.9550, PSEC 1.1.