Development record
Folders in abcd's home that an earlier abcd, a hand-run `mkdir`, or `git worktree add` created at the process umask are readable by every other account on the computer whenever the home itself is too: a home made 0755 keeps that mode, because every abcd writer leaves an existing folder's mode as it stands ([dcn-2610040000000007](../../decisions/dcn-2610040000000007-decided-without-a-question-by-abcd-50.md)). On a Mac where `~` is 0750 group staff and every local account is in staff, the other accounts can list and read `~/.abcd.noindex/{worktrees,runs,history,lifeboats,review-copies,scratch,sources,lab}` (each 0755), which hold private checkouts and session material. A lane worktree git adds into the store is 0755 whatever the store's mode.
issueresolvedmajoriss-2610120949163534
Folders in abcd's home that an earlier abcd, a hand-run mkdir, or git worktree add created at the process umask are readable by every other account on the computer whenever the home itself is too: a home made 0755 keeps that mode, because every abcd writer leaves an existing folder's mode as it stands (dcn-2610040000000007). On a Mac where ~ is 0750 group staff and every local account is in staff, the other accounts can list and read ~/.abcd.noindex/{worktrees,runs,history,lifeboats,review-copies,scratch,sources,lab} (each 0755), which hold private checkouts and session material. A lane worktree git adds into the store is 0755 whatever the store's mode.
Grounds
- pursued: TestTheFrontDoorNarrowsAnOpenHome, TestTheFrontDoorLeavesASymlinkedHome, TestNarrowToOwner* (foreign owner, link, file) and TestTheWorktreeStepMakesTheLaneWorktreeTheCallersAlone; a 0755 home or lane worktree left open, or a symlink target re-moded, would show it wrong
Frontmatter
| id | iss-2610120949163534 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | major |
.abcd/work/issues/resolved/iss-2610120949163534-home-folders-readable-by-other-accounts.md
open on GitHub ↗ · commit history ↗
mentions2
- dcn-26100400000000072026-10-04 — Decided without a question by abcd-50 (one defensible answer), on the security review of the home-mode fix (iss-2610032205304585): an existing abcd home keeps the mode it has, because every home-scope writer's contract is that a level which already exists keeps its mode (fsutil.EnsureHomeScope, fsutil.EnsureRealDir) and re-moding a folder on the person's machine is a change the issue did not ask for; the two records an earlier version wrote 0o644 (the path-entry record and the registry's index) are narrowed to 0o600 at their next write instead (the bootstrap re-stamps path-entry at every provision, the registry rewrites its index at every registration), so on an existing 0o755 home the residual is that other accounts can list the folder's names, never read a record abcd keeps there. Not chosen: chmod an existing home to 0o700 when the account owns it.
- dcn-26101200000000022026-10-12 — An existing abcd home is narrowed to the account's alone, reversing the 2026-10-04 decision that it keeps the mode it has (iss-2610120949163534), on the security standard ruling of 2026-10-11 (abcd fixes the risks it adds): a home made 0755 by an earlier abcd or by hand leaves every folder abcd keeps in it (worktrees, runs, history, lab, sources) readable by the other accounts in the home directory's group. At the CLI front door, before any verb runs, a ~/.abcd.noindex this account owns that is a real directory has its group and other bits removed (fsutil.NarrowToOwner, on the opened descriptor, never following a symlink); a symlinked home, one another account owns and an absent one are left alone, and nothing below the home is walked or re-moded, because closing the home closes everything in it. A lane worktree git adds into the store is narrowed the same way after the add. Writers keep their contract that a folder they find keeps its mode; only the home itself is narrowed. Not chosen: re-moding every folder below the home, which would change folders a person may have opened deliberately and gains nothing once the home is closed.