Development record
The history registry's locked rewrite took its lock through one walk of ~/.abcd/history and loaded and wrote index.json through two further walks (registerRepo: withHistoryLock, loadHistoryIndex, writeHistoryIndex each opened the directory afresh), so a same-uid swap of ~/.abcd/history once the lock was held sent the load and the write to a directory whose lock was never taken. The same shape as iss-2609290300313698, found while sweeping that pattern.
issueresolvedminoriss-2609291246244867
The history registry's locked rewrite took its lock through one walk of ~/.abcd/history and loaded and wrote index.json through two further walks (registerRepo: withHistoryLock, loadHistoryIndex, writeHistoryIndex each opened the directory afresh), so a same-uid swap of ~/.abcd/history once the lock was held sent the load and the write to a directory whose lock was never taken. The same shape as iss-2609290300313698, found while sweeping that pattern.
Grounds
- pursued: the history registry's rewrite happens in the directory its lock covers; shown wrong if TestRegisterRepoWritesTheIndexItLocked sees the registration land in a directory swapped in after the lock
Frontmatter
| id | iss-2609291246244867 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2609291246244867-the-history-registry-s-locked-rewrite.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2609290300313698The credential index can split between two ~/.abcd directories under a same-uid swap of one real directory for another between Set's walk and the index's re-walk. Set opens ~/.abcd once by descriptor and writes the index through that held root (store.go setIndex, WriteFileAtomicInRoot), but readIndex under the index lock re-walks ~/.abcd by path (fsutil.ReadHomeDeclarationDenying). If ~/.abcd is renamed aside and a different real directory swapped in between the two walks, the index read comes from the new directory while the write goes to the held one: the held directory's index becomes the new one's entries plus the new name (its own entries lost), and the live ~/.abcd does not record the new name. Names, homes and pointers only, never a value: SetMachine re-walks for its read and its write, so the value and its store stay together in the live directory. Same uid, who can edit either file directly. Surfaced by the security review of integ/land-14 (review-integ14 item 4, LOW (b)).