Development record
The credential index can split between two ~/.abcd directories under a same-uid swap of one real directory for another between Set's walk and the index's re-walk. Set opens ~/.abcd once by descriptor and writes the index through that held root (store.go setIndex, WriteFileAtomicInRoot), but readIndex under the index lock re-walks ~/.abcd by path (fsutil.ReadHomeDeclarationDenying). If ~/.abcd is renamed aside and a different real directory swapped in between the two walks, the index read comes from the new directory while the write goes to the held one: the held directory's index becomes the new one's entries plus the new name (its own entries lost), and the live ~/.abcd does not record the new name. Names, homes and pointers only, never a value: SetMachine re-walks for its read and its write, so the value and its store stay together in the live directory. Same uid, who can edit either file directly. Surfaced by the security review of integ/land-14 (review-integ14 item 4, LOW (b)).
The credential index can split between two ~/.abcd directories under a same-uid swap of one real directory for another between Set's walk and the index's re-walk. Set opens ~/.abcd once by descriptor and writes the index through that held root (store.go setIndex, WriteFileAtomicInRoot), but readIndex under the index lock re-walks ~/.abcd by path (fsutil.ReadHomeDeclarationDenying). If ~/.abcd is renamed aside and a different real directory swapped in between the two walks, the index read comes from the new directory while the write goes to the held one: the held directory's index becomes the new one's entries plus the new name (its own entries lost), and the live ~/.abcd does not record the new name. Names, homes and pointers only, never a value: SetMachine re-walks for its read and its write, so the value and its store stay together in the live directory. Same uid, who can edit either file directly. Surfaced by the security review of integ/land-14 (review-integ14 item 4, LOW (b)).
Grounds
- pursued: a read-modify-write under a home-scoped lock reads and writes one directory; shown wrong if TestSetKeepsTheIndexInTheDirectoryItHolds, TestSetMachineKeepsTheStoreInTheDirectoryItHolds or TestTheProviderBlockIsReadWhereItIsWritten sees an entry cross between the held and the swapped-in directory
Frontmatter
| id | iss-2609290300313698 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2609290300313698-the-credential-index-can-split-under-a.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2609291246244867The history registry's locked rewrite took its lock through one walk of ~/.abcd/history and loaded and wrote index.json through two further walks (registerRepo: withHistoryLock, loadHistoryIndex, writeHistoryIndex each opened the directory afresh), so a same-uid swap of ~/.abcd/history once the lock was held sent the load and the write to a directory whose lock was never taken. The same shape as iss-2609290300313698, found while sweeping that pattern.