From 26a0f45269012e5fb528356d7c1d4600a98841ce Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 12 Oct 2026 15:23:17 +0200 Subject: [PATCH] Register R358: a parent swapped for a link leaves its target untouched (hq issue 358) Proved with go run ./cmd/prove R358: fails on mesh-host#87's commit before (dce0eef), passes on the fix (36704b5, mesh-host#87). --- replays/register.go | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/replays/register.go b/replays/register.go index 34b7ae5..a38b02f 100644 --- a/replays/register.go +++ b/replays/register.go @@ -313,6 +313,20 @@ var Register = []Replay{ "refused naming the character and how a quote is written, quoting none of the line", Package: "./cmd/mesh-controller", Test: "TestAQuotedValueCanHoldAQuote", Files: []string{"cmd/mesh-controller/seatverbs_test.go"}}, + // A mesh directory outside every home was changed by path (2026-10-12): the directory applier set a + // directory's mode and owner by calling chmod and chown on its path, which follows a link anywhere in + // the path, so an account able to swap a parent for a link between two applies could direct root's + // chmod and chown at the link's target. Found by code reading, no known exploit. A test in the + // node-engine, written only with what applyDirectory had before its fix, laid over the commit before + // (mesh-host #87). Fix is the merge of its pull request. + {ID: "R358", Issue: 358, Kind: InRepository, Repository: "mesh-host", Fix: "36704b5471cb7b4e585847a08e4fd7fd64aea357", + What: "a mesh directory outside every home was given its mode and owner by path, so a parent swapped " + + "for a link between two applies carried root's chmod and chown to the link's target", + Asserts: "no apply changes the mode or owner of anything but the directory its declaration names, " + + "however a parent of its path is swapped for a link between applies, and the refusal names the link " + + "and the account that could have made it", + Package: "./internal/apply", Test: "TestAParentSwappedForALinkLeavesItsTargetUntouched", + Files: []string{"internal/apply/replay358_test.go"}}, // Not a core incident, and the first of its kind: a module's. The crash loop was found by a person // reading the agent server's log for another reason (issue 268); research 032 measured it, and ADR // 0240 makes the node-engine judge it and the gate fail it. -- 2.54.0