novox/mesh-lab
6
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

Register R358: a parent swapped for a link leaves its target untouched (hq issue 358)
mesh/merge-gate pass: the change touches no module of the mesh's graph
Details
mesh/repo-check pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (typescript), replays/merge-check.sh (go), asks/merge-check.sh …
Details
mesh/delivery delivered
Details

Browse Source 
Proved with go run ./cmd/prove R358: fails on mesh-host#87's commit before
(dce0eef), passes on the fix (36704b5, mesh-host#87).
This commit is contained in:
jochen
2026-10-12 15:23:17 +02:00
parent 9bd51f3c6c
commit 26a0f45269
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
replays/register.go
+14
View File
@@ -313,6 +313,20 @@ var Register = []Replay{
"refused naming the character and how a quote is written, quoting none of the line",
Package: "./cmd/mesh-controller", Test: "TestAQuotedValueCanHoldAQuote",
Files: []string{"cmd/mesh-controller/seatverbs_test.go"}},
// A mesh directory outside every home was changed by path (2026-10-12): the directory applier set a
// directory's mode and owner by calling chmod and chown on its path, which follows a link anywhere in
// the path, so an account able to swap a parent for a link between two applies could direct root's
// chmod and chown at the link's target. Found by code reading, no known exploit. A test in the
// node-engine, written only with what applyDirectory had before its fix, laid over the commit before
// (mesh-host #87). Fix is the merge of its pull request.
{ID: "R358", Issue: 358, Kind: InRepository, Repository: "mesh-host", Fix: "36704b5471cb7b4e585847a08e4fd7fd64aea357",
What: "a mesh directory outside every home was given its mode and owner by path, so a parent swapped " +
"for a link between two applies carried root's chmod and chown to the link's target",
Asserts: "no apply changes the mode or owner of anything but the directory its declaration names, " +
"however a parent of its path is swapped for a link between applies, and the refusal names the link " +
"and the account that could have made it",
Package: "./internal/apply", Test: "TestAParentSwappedForALinkLeavesItsTargetUntouched",
Files: []string{"internal/apply/replay358_test.go"}},
// Not a core incident, and the first of its kind: a module's. The crash loop was found by a person
// reading the agent server's log for another reason (issue 268); research 032 measured it, and ADR
// 0240 makes the node-engine judge it and the gate fail it.