carlos / platform Public

guard-arm: repair the shared system parent and make the lock dir without the umask (review fix)

Astra: the lock directory's os.MkdirAll could still create
<opt>/system 0700 under umask 077, closing the guard directories' parent
to non-root units. prepareGuardArmLockDir repairs <opt>/system to 0755
and makes the lock directory through mkdirAllExact. A test covers the
real order (lock dir, then guard dirs) with and without a 0700 parent
left by an earlier run. Census re-pinned under census-ruling-claim-guard-umask.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 5 days ago 94ff6af27c4f5c7848e7ba6182f6da284c96644e parent b01ba4d

3 files changed, +50 −4

internal/host/guardarm.go +13 −1
internal/host/guardarm_mkdir_linux_test.go +34 −0
internal/provision/testdata/plan14-root-reads-claim-guard-umask.tsv +3 −3

CI passed — run details

CI log

=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.012s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	330.572s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	2.753s
ok  	github.com/carlosframework/platform/cmd/moveprobe	92.232s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.709s
ok  	github.com/carlosframework/platform/internal/activator	251.499s
ok  	github.com/carlosframework/platform/internal/agentsock	0.017s
ok  	github.com/carlosframework/platform/internal/alerting	0.004s
ok  	github.com/carlosframework/platform/internal/analytics	0.020s
ok  	github.com/carlosframework/platform/internal/appconfig	2.461s
ok  	github.com/carlosframework/platform/internal/apperr	0.072s
ok  	github.com/carlosframework/platform/internal/applog	0.139s
ok  	github.com/carlosframework/platform/internal/awsinv	0.003s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.004s
ok  	github.com/carlosframework/platform/internal/boxid	0.962s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.008s
ok  	github.com/carlosframework/platform/internal/caps	0.012s
ok  	github.com/carlosframework/platform/internal/certwarm	0.004s
ok  	github.com/carlosframework/platform/internal/cgroup	0.702s
ok  	github.com/carlosframework/platform/internal/changelog	0.314s
ok  	github.com/carlosframework/platform/internal/claimactivation	0.788s
ok  	github.com/carlosframework/platform/internal/clamd	0.054s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	409.411s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	5.688s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.009s
ok  	github.com/carlosframework/platform/internal/dbverify	0.005s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.002s
ok  	github.com/carlosframework/platform/internal/docsite	0.005s
ok  	github.com/carlosframework/platform/internal/domains	2.396s
ok  	github.com/carlosframework/platform/internal/doorkey	0.006s
ok  	github.com/carlosframework/platform/internal/economics	0.004s
ok  	github.com/carlosframework/platform/internal/edge	45.096s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.008s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.131s
ok  	github.com/carlosframework/platform/internal/gate	1.656s
ok  	github.com/carlosframework/platform/internal/genselect	0.015s
ok  	github.com/carlosframework/platform/internal/geo	0.009s
ok  	github.com/carlosframework/platform/internal/geoip	0.030s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.152s
ok  	github.com/carlosframework/platform/internal/host	184.005s
ok  	github.com/carlosframework/platform/internal/hostactors	6.000s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.005s
ok  	github.com/carlosframework/platform/internal/hostbox	2.648s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.571s
ok  	github.com/carlosframework/platform/internal/hostenv	0.004s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.005s
ok  	github.com/carlosframework/platform/internal/hostexec	4.933s
ok  	github.com/carlosframework/platform/internal/hostfence	0.029s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.463s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.016s
ok  	github.com/carlosframework/platform/internal/hostguard	1.028s
ok  	github.com/carlosframework/platform/internal/hostops	1.609s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.004s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.002s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.477s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.165s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.002s
ok  	github.com/carlosframework/platform/internal/infraview	0.016s
ok  	github.com/carlosframework/platform/internal/instancectl	5.230s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.756s
ok  	github.com/carlosframework/platform/internal/instancefs	0.020s
ok  	github.com/carlosframework/platform/internal/instancekey	0.016s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.023s
ok  	github.com/carlosframework/platform/internal/layout	1.571s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.003s
ok  	github.com/carlosframework/platform/internal/lease	9.816s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.009s
ok  	github.com/carlosframework/platform/internal/ledger	0.017s
ok  	github.com/carlosframework/platform/internal/mail	0.165s
ok  	github.com/carlosframework/platform/internal/maintenance	0.082s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.493s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.066s
ok  	github.com/carlosframework/platform/internal/metrics	0.005s
ok  	github.com/carlosframework/platform/internal/moves	21.177s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.822s
ok  	github.com/carlosframework/platform/internal/objstore	0.188s
ok  	github.com/carlosframework/platform/internal/ops	0.189s
ok  	github.com/carlosframework/platform/internal/park	0.219s
ok  	github.com/carlosframework/platform/internal/privatefile	0.005s
ok  	github.com/carlosframework/platform/internal/provision	37.341s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.008s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.432s
ok  	github.com/carlosframework/platform/internal/relay	7.224s
ok  	github.com/carlosframework/platform/internal/release	24.276s
ok  	github.com/carlosframework/platform/internal/rollout	3.797s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.003s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.058s
ok  	github.com/carlosframework/platform/internal/rootstate	0.026s
ok  	github.com/carlosframework/platform/internal/runs	0.573s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.005s
ok  	github.com/carlosframework/platform/internal/schedule	2.504s
ok  	github.com/carlosframework/platform/internal/seeds	0.010s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	9.607s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.747s
ok  	github.com/carlosframework/platform/internal/status	0.062s
ok  	github.com/carlosframework/platform/internal/steering	0.005s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.303s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.004s
ok  	github.com/carlosframework/platform/internal/unixdial	0.002s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.004s
ok  	github.com/carlosframework/platform/internal/version	0.001s
ok  	github.com/carlosframework/platform/internal/vet	1.565s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 49414306 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: downloading https://github.com/minio/minio/releases/download/RELEASE.2025-09-07T16-13-09Z/minio.linux-arm64.RELEASE.2025-09-07T16-13-09Z
  minio: downloaded, digest verified
  mc: downloading https://github.com/minio/mc/releases/download/RELEASE.2025-08-13T08-35-41Z/mc.linux-arm64.RELEASE.2025-08-13T08-35-41Z
  mc: downloaded, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.023s
=== RUN   TestT4StorageProbeMinio
2026/10/19 17:58:42 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18E0001076A919D5, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.021s
minio contract: PASS

diff --git a/internal/host/guardarm.go b/internal/host/guardarm.go

index f0d09bc37..f879eaafe 100644

--- a/internal/host/guardarm.go

+++ b/internal/host/guardarm.go

@@ -31,7 +31,7 @@ func RunSystemGuardArm(args []string) {

log.Fatal(hostfloor.ErrFloor)

}

lockDir := systemRootDir(release.OptDir())

- if err := os.MkdirAll(lockDir, 0755); err != nil {

+ if err := prepareGuardArmLockDir(release.OptDir(), lockDir); err != nil {

log.Fatal(err)

}

lock, err := os.OpenFile(filepath.Join(lockDir, systemLockFile), os.O_CREATE|os.O_RDWR, 0600)

@@ -300,3 +300,15 @@ func mkdirAllExact(dir string, mode os.FileMode) error {

}

return nil

}

+// prepareGuardArmLockDir makes guard-arm's lock directory under

+// <opt>/system without the caller's umask, and repairs <opt>/system itself

+// to 0755: the guard directories sit under the same parent and non-root

+// units exec the guard binary through it, so a umask 077 run must not

+// leave it closed.

+func prepareGuardArmLockDir(optDir, lockDir string) error {

+ if err := mkdirAllExact(filepath.Join(optDir, "system"), 0755); err != nil {

+ return err

+ }

+ return mkdirAllExact(lockDir, 0755)

diff --git a/internal/host/guardarm_mkdir_linux_test.go b/internal/host/guardarm_mkdir_linux_test.go

index 906be977a..ea2e76eb9 100644

--- a/internal/host/guardarm_mkdir_linux_test.go

+++ b/internal/host/guardarm_mkdir_linux_test.go

@@ -45,3 +45,37 @@ func TestMkdirAllExactIgnoresUmask(t *testing.T) {

t.Fatalf("existing dir not repaired: %o", st.Mode().Perm())

}

+// guard-arm makes its lock directory before the guard directories, under the

+// same <opt>/system parent: neither step may leave that parent closed, and a

+// parent an earlier run left 0700 is repaired.

+func TestGuardArmDirsIgnoreUmaskInOrder(t *testing.T) {

+ old := syscall.Umask(0o077)

+ defer syscall.Umask(old)

+ for _, preexisting := range []bool{false, true} {

+ opt := t.TempDir()

+ if preexisting {

+ if err := os.MkdirAll(filepath.Join(opt, "system"), 0o700); err != nil {

+ t.Fatal(err)

+ }

+ if err := prepareGuardArmLockDir(opt, systemRootDir(opt)); err != nil {

+ t.Fatal(err)

+ }

+ guard := systemGuardDir(opt)

+ for _, dir := range []string{guard, filepath.Join(guard, "identities")} {

+ if err := mkdirAllExact(dir, 0o755); err != nil {

+ t.Fatal(err)

+ }

+ for _, p := range []string{filepath.Join(opt, "system"), systemRootDir(opt), guard, filepath.Join(guard, "identities")} {

+ st, err := os.Stat(p)

+ if err != nil {

+ t.Fatal(err)

+ }

+ if st.Mode().Perm() != 0o755 {

+ t.Fatalf("preexisting=%v: %s is %o, want 755", preexisting, p, st.Mode().Perm())

+ }

diff --git a/internal/provision/testdata/plan14-root-reads-claim-guard-umask.tsv b/internal/provision/testdata/plan14-root-reads-claim-guard-umask.tsv

index d6ba8d084..f0d576dab 100644

--- a/internal/provision/testdata/plan14-root-reads-claim-guard-umask.tsv

+++ b/internal/provision/testdata/plan14-root-reads-claim-guard-umask.tsv

@@ -1,5 +1,5 @@

# Census overlay claim-guard-umask (guard-arm's directories ignore the caller's umask; amadan issue drafted 2026-10-19), loaded LAST, after claim-untagged-pointer-fix2. Ruled by platform-1e as census owner: census-ruling-claim-guard-umask.

-# RunSystemGuardArm: the guard and identities directories are now made through mkdirAllExact instead of os.MkdirAll; its read sites are the same files at shifted offsets. mkdirAllExact (new): Lstat walks up only to find which components it creates, then chmods exactly those and the target to 0755. It reads no file content and grants nothing. The seal stands: no accepted-legacy row. No 9B8 entry: it writes no record.

-@coverage internal/host eb14b3eea2f1fb467aa899a71621e30404cfd1424f030fa320b34a04ebb481c1

-internal/host/guardarm.go RunSystemGuardArm authority F,J4 rev3=census-ruling-claim-guard-umask;identity=carlos system guard-arm, offline CLI uid 0;basis=root guard-arm checks retained census floor before installing guard; no census retains main; policy and identity parse in guardArmInputs, same files read; guard directories made through mkdirAllExact file:OpenFile@565,file:ReadFile@1572,file:ReadFile@5883,file:ReadFile@865,file:ReadFile@945,file:Stat@3534 a6bd0a2da1b5e4d19f3c58da8331dbc5e166da31aba289c77153afe4f28a4cbb

+# RunSystemGuardArm: the guard and identities directories are now made through mkdirAllExact instead of os.MkdirAll; its read sites are the same files at shifted offsets. mkdirAllExact (new): Lstat walks up only to find which components it creates, then chmods exactly those and the target to 0755. It reads no file content and grants nothing. The seal stands: no accepted-legacy row. No 9B8 entry: it writes no record. prepareGuardArmLockDir (new) has no read site of its own: it repairs <opt>/system to 0755 and makes the lock directory, both through mkdirAllExact.

+@coverage internal/host 2b1aa5edb15838c6b33bf606e0c3c7b05c4931a68b3adef8f384926a5498f64a

+internal/host/guardarm.go RunSystemGuardArm authority F,J4 rev3=census-ruling-claim-guard-umask;identity=carlos system guard-arm, offline CLI uid 0;basis=root guard-arm checks retained census floor before installing guard; no census retains main; policy and identity parse in guardArmInputs, same files read; guard directories, the shared system parent and the lock directory made through mkdirAllExact file:OpenFile@588,file:ReadFile@1595,file:ReadFile@5906,file:ReadFile@888,file:ReadFile@968,file:Stat@3557 23ad7a4d52c3c004f701a937f26b0f58f115b9a007aa7b15446bfa45aacf2b3c

internal/host/guardarm.go mkdirAllExact authority G,J4 rev3=census-ruling-claim-guard-umask;identity=carlos system guard-arm, offline CLI uid 0;basis=Lstat of the target path and its missing parents only, to choose which directories to create and chmod to 0755; no file content is read file:Lstat@149 d1c988f22c5559ba6765ba9072d3fbbf26fd33836ab672157cb4e1bd9b99aaf3