Issue 339: any caller of the settings verb could have the node-engine hand a system directory to an account #234

2026-10-08T22:00:45Z

mesh-admin commented

2026-10-08 22:00:45 +00:00

Registers issue 339 (status: located, critical). Do not merge without review.

Symptom (read in code, not run): the places setting moves a module's directory to any absolute path with any uid:gid owner, and accesses names any path to mount into its container. Both went through the ordinary settings verb (and command "settings set …"). The node-engine then chowned and chmodded the directory as root, through a link too. One call plus a push hands /etc to an account. A line break in any setting adds a line to a file written as root.
ADR 0266's boundary depends on this fix. The issue says so. ADR 0266 is still on PR #225, so it is named without a link.
Located: mesh-controller #168 (terminal-only keys through every verb route, system-tree refusal everywhere, one-line settings) and mesh-host #63 (the engine's guard, links not followed, a found directory used as found). They are independent.
Step 3 (live, read-only): all 381 layers were read (136 modules, whole mesh plus each assigned machine). 15 set places/accesses, all legitimate data placements, none in a system tree. The engine's guard over today's declarations for all four nodes refused nothing.
The diagnosis ends with the live acceptance calls to run after both merge.

Checks run locally: records.py, index.py, cycle.py, words.py (with the catalogue's list) all pass.

Registers issue 339 (status: located, critical). Do not merge without review. - **Symptom (read in code, not run):** the `places` setting moves a module's directory to any absolute path with any `uid:gid` owner, and `accesses` names any path to mount into its container. Both went through the ordinary `settings` verb (and `command "settings set …"`). The node-engine then chowned and chmodded the directory as root, through a link too. One call plus a push hands `/etc` to an account. A line break in any setting adds a line to a file written as root. - **ADR 0266's boundary depends on this fix.** The issue says so. ADR 0266 is still on PR #225, so it is named without a link. - **Located:** mesh-controller #168 (terminal-only keys through every verb route, system-tree refusal everywhere, one-line settings) and mesh-host #63 (the engine's guard, links not followed, a found directory used as found). They are independent. - **Step 3 (live, read-only):** all 381 layers were read (136 modules, whole mesh plus each assigned machine). 15 set `places`/`accesses`, all legitimate data placements, none in a system tree. The engine's guard over today's declarations for all four nodes refused nothing. - The diagnosis ends with the live acceptance calls to run after both merge. Checks run locally: records.py, index.py, cycle.py, words.py (with the catalogue's list) all pass.

mesh-admin added 1 commit 2026-10-08 22:00:45 +00:00

Issue 339: any caller of the settings verb could have the node-engine hand a system directory to an account

mesh/delivery delivered

Details

mesh/merge-gate pass: the change touches no module of the mesh's graph

Details

mesh/repo-check pass: its merge-check.sh passed

Details

ac3a67ebab

Located in the controller (places and accesses taken through every verb, no line-break check) and the node-engine (a found directory chowned as root, through a link too, and any path mounted). ADR 0266's boundary depends on the fix.

mesh-admin commented

2026-10-08 22:01:08 +00:00

Delivery novox/hq@ac3a67ebaba5 — delivered since 2026-10-08T22:21:10Z

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Transitions

2026-10-08 22:01 (new) → proposed (announced): novox/hq#234's head announced
2026-10-08 22:01 proposed → checked (checked): the verdict names this commit
2026-10-08 22:01 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-08 22:21 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-08 22:21 published → delivered (done): nothing for a walk to move

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/hq@ac3a67ebaba5` — **delivered** since 2026-10-08T22:21:10Z **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Transitions** - 2026-10-08 22:01 (new) → proposed (announced): novox/hq#234's head announced - 2026-10-08 22:01 proposed → checked (checked): the verdict names this commit - 2026-10-08 22:01 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-08 22:21 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-08 22:21 published → delivered (done): nothing for a walk to move The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin merged commit 0f02ac47d4 into main

2026-10-08 22:21:03 +00:00

mesh-admin deleted branch issues/339-a-verb-can-place-a-directory-at-the-machines-own

2026-10-08 22:21:03 +00:00

mesh-admin referenced this pull request

2026-10-08 22:29:19 +00:00

Issue 339: the merge order against mesh-host #61, used-as-found as a behaviour change, the review's follow-ups #236

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#234