Development record
fsutil.ReadDeclaration judges a home-scoped declaration's owner and permissions on an Lstat, then reads it through ReadGuarded's later open by path with no os.SameFile check between the two, so a co-tenant with write on the declaration's directory can rename-swap a different file in after the vetting and have it read as the caller's word; ReadGuardedInRoot already closes the same lstat-to-open window with os.SameFile. Callers: the rules user layer (~/.abcd/rules.json), trusted-roots, local-transcript-roots, path-entry, cache attestation and the implement limits file.
issueresolvedminoriss-2609251537550065
fsutil.ReadDeclaration judges a home-scoped declaration's owner and permissions on an Lstat, then reads it through ReadGuarded's later open by path with no os.SameFile check between the two, so a co-tenant with write on the declaration's directory can rename-swap a different file in after the vetting and have it read as the caller's word; ReadGuardedInRoot already closes the same lstat-to-open window with os.SameFile. Callers: the rules user layer (~/.abcd/rules.json), trusted-roots, local-transcript-roots, path-entry, cache attestation and the implement limits file.
Grounds
- pursued: every home-scoped declaration read refuses a file renamed into place between the vetting lstat and the open; TestReadDeclarationRefusesAFileSwappedInAfterVetting would show it wrong by reading the swapped bytes
Frontmatter
| id | iss-2609251537550065 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2609251537550065-fsutil-readdeclaration-judges-a-home.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2609290656491358statusline.ReadSettingsFile vets ~/.abcd/statusline.json with its own os.Lstat and fsutil.CallersAlone, then reads it through fsutil.ReadGuardedInRoot, whose own Lstat and os.SameFile tie the bytes to a second look at the path that checks neither mode nor owner. A file renamed over statusline.json between the two looks (group- or other-writable, or another account's) is read and honoured, including the previous_command the harness runs on every refresh. It is the vet-then-read-by-a-second-look shape iss-2609251537550065 closed in fsutil.ReadDeclaration, kept by hand in one reader instead of going through the canonical home-declaration read.