Development record
statusline.ReadSettingsFile vets ~/.abcd/statusline.json with its own os.Lstat and fsutil.CallersAlone, then reads it through fsutil.ReadGuardedInRoot, whose own Lstat and os.SameFile tie the bytes to a second look at the path that checks neither mode nor owner. A file renamed over statusline.json between the two looks (group- or other-writable, or another account's) is read and honoured, including the previous_command the harness runs on every refresh. It is the vet-then-read-by-a-second-look shape iss-2609251537550065 closed in fsutil.ReadDeclaration, kept by hand in one reader instead of going through the canonical home-declaration read.
statusline.ReadSettingsFile vets ~/.abcd/statusline.json with its own os.Lstat and fsutil.CallersAlone, then reads it through fsutil.ReadGuardedInRoot, whose own Lstat and os.SameFile tie the bytes to a second look at the path that checks neither mode nor owner. A file renamed over statusline.json between the two looks (group- or other-writable, or another account's) is read and honoured, including the previous_command the harness runs on every refresh. It is the vet-then-read-by-a-second-look shape iss-2609251537550065 closed in fsutil.ReadDeclaration, kept by hand in one reader instead of going through the canonical home-declaration read.
Grounds
- pursued: a file renamed over statusline.json after any look by path is judged as itself or not read; a test that renames a world-writable file in during the read and gets its bytes back would show it wrong
Frontmatter
| id | iss-2609290656491358 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2609290656491358-statusline-readsettingsfile-vets-abcd.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2609251537550065fsutil.ReadDeclaration judges a home-scoped declaration's owner and permissions on an Lstat, then reads it through ReadGuarded's later open by path with no os.SameFile check between the two, so a co-tenant with write on the declaration's directory can rename-swap a different file in after the vetting and have it read as the caller's word; ReadGuardedInRoot already closes the same lstat-to-open window with os.SameFile. Callers: the rules user layer (~/.abcd/rules.json), trusted-roots, local-transcript-roots, path-entry, cache attestation and the implement limits file.