carlos / platform Public

claim-guard-umask: guard-arm makes its guard, system and lock directories 0755 whatever the caller's umask (#317)

Squashed from claim-guard-umask into main.

claude 5 days ago 96db0efe4a0dc94f26cc8e01d5ed8c5c07e3296a parent f3bf121

4 files changed, +139 −2

internal/host/guardarm.go +45 −2
internal/host/guardarm_mkdir_linux_test.go +81 −0
internal/provision/plan14_root_reads_test.go +8 −0
internal/provision/testdata/plan14-root-reads-claim-guard-umask.tsv +5 −0

CI passed — run details

CI log

=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.011s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	316.265s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	2.791s
ok  	github.com/carlosframework/platform/cmd/moveprobe	92.196s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.718s
ok  	github.com/carlosframework/platform/internal/activator	250.711s
ok  	github.com/carlosframework/platform/internal/agentsock	0.015s
ok  	github.com/carlosframework/platform/internal/alerting	0.004s
ok  	github.com/carlosframework/platform/internal/analytics	0.019s
ok  	github.com/carlosframework/platform/internal/appconfig	2.461s
ok  	github.com/carlosframework/platform/internal/apperr	0.071s
ok  	github.com/carlosframework/platform/internal/applog	0.172s
ok  	github.com/carlosframework/platform/internal/awsinv	0.003s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.007s
ok  	github.com/carlosframework/platform/internal/boxid	0.516s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.008s
ok  	github.com/carlosframework/platform/internal/caps	0.012s
ok  	github.com/carlosframework/platform/internal/certwarm	0.002s
ok  	github.com/carlosframework/platform/internal/cgroup	0.695s
ok  	github.com/carlosframework/platform/internal/changelog	0.320s
ok  	github.com/carlosframework/platform/internal/claimactivation	0.815s
ok  	github.com/carlosframework/platform/internal/clamd	0.055s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	406.954s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	5.921s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.009s
ok  	github.com/carlosframework/platform/internal/dbverify	0.005s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.003s
ok  	github.com/carlosframework/platform/internal/docsite	0.005s
ok  	github.com/carlosframework/platform/internal/domains	2.363s
ok  	github.com/carlosframework/platform/internal/doorkey	0.006s
ok  	github.com/carlosframework/platform/internal/economics	0.004s
ok  	github.com/carlosframework/platform/internal/edge	44.929s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.008s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.135s
ok  	github.com/carlosframework/platform/internal/gate	1.655s
ok  	github.com/carlosframework/platform/internal/genselect	0.019s
ok  	github.com/carlosframework/platform/internal/geo	0.016s
ok  	github.com/carlosframework/platform/internal/geoip	0.031s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.154s
ok  	github.com/carlosframework/platform/internal/host	182.848s
ok  	github.com/carlosframework/platform/internal/hostactors	5.707s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.013s
ok  	github.com/carlosframework/platform/internal/hostbox	2.791s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.569s
ok  	github.com/carlosframework/platform/internal/hostenv	0.013s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.013s
ok  	github.com/carlosframework/platform/internal/hostexec	4.941s
ok  	github.com/carlosframework/platform/internal/hostfence	0.033s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.506s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.016s
ok  	github.com/carlosframework/platform/internal/hostguard	1.047s
ok  	github.com/carlosframework/platform/internal/hostops	1.632s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.013s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.013s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.470s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.164s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.013s
ok  	github.com/carlosframework/platform/internal/infraview	0.016s
ok  	github.com/carlosframework/platform/internal/instancectl	5.242s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.771s
ok  	github.com/carlosframework/platform/internal/instancefs	0.020s
ok  	github.com/carlosframework/platform/internal/instancekey	0.015s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.019s
ok  	github.com/carlosframework/platform/internal/layout	1.555s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.016s
ok  	github.com/carlosframework/platform/internal/lease	9.856s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.009s
ok  	github.com/carlosframework/platform/internal/ledger	0.010s
ok  	github.com/carlosframework/platform/internal/mail	0.195s
ok  	github.com/carlosframework/platform/internal/maintenance	0.079s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.535s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.077s
ok  	github.com/carlosframework/platform/internal/metrics	0.005s
ok  	github.com/carlosframework/platform/internal/moves	21.191s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.781s
ok  	github.com/carlosframework/platform/internal/objstore	0.198s
ok  	github.com/carlosframework/platform/internal/ops	0.182s
ok  	github.com/carlosframework/platform/internal/park	0.203s
ok  	github.com/carlosframework/platform/internal/privatefile	0.004s
ok  	github.com/carlosframework/platform/internal/provision	37.255s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.015s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.453s
ok  	github.com/carlosframework/platform/internal/relay	7.234s
ok  	github.com/carlosframework/platform/internal/release	23.979s
ok  	github.com/carlosframework/platform/internal/rollout	3.809s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.004s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.060s
ok  	github.com/carlosframework/platform/internal/rootstate	0.028s
ok  	github.com/carlosframework/platform/internal/runs	0.567s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.512s
ok  	github.com/carlosframework/platform/internal/seeds	0.011s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	9.646s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	4.432s
ok  	github.com/carlosframework/platform/internal/status	0.068s
ok  	github.com/carlosframework/platform/internal/steering	0.006s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.297s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.004s
ok  	github.com/carlosframework/platform/internal/unixdial	0.002s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.005s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.575s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 49414306 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: cached, digest verified
  mc: cached, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.024s
=== RUN   TestT4StorageProbeMinio
2026/10/19 18:13:52 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18E000E44EB14168, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.021s
minio contract: PASS

diff --git a/internal/host/guardarm.go b/internal/host/guardarm.go

index 98e4c7693..f879eaafe 100644

--- a/internal/host/guardarm.go

+++ b/internal/host/guardarm.go

@@ -31,7 +31,7 @@ func RunSystemGuardArm(args []string) {

log.Fatal(hostfloor.ErrFloor)

}

lockDir := systemRootDir(release.OptDir())

- if err := os.MkdirAll(lockDir, 0755); err != nil {

+ if err := prepareGuardArmLockDir(release.OptDir(), lockDir); err != nil {

log.Fatal(err)

}

lock, err := os.OpenFile(filepath.Join(lockDir, systemLockFile), os.O_CREATE|os.O_RDWR, 0600)

@@ -111,8 +111,12 @@ func RunSystemGuardArm(args []string) {

if err = guardArmControllers(dataDir()); err != nil {

log.Fatal(err)

}

+ // The guard directories are traversed by non-root units (the console

+ // and the edge exec the guard binary through them), so their mode

+ // cannot depend on the caller's umask: a umask 077 shell once left

+ // them 0700 and the guarded console failed with exit 203.

for _, dir := range []string{d.Dir, filepath.Join(d.Dir, "identities")} {

- if err = os.MkdirAll(dir, 0755); err != nil {

+ if err = mkdirAllExact(dir, 0755); err != nil {

log.Fatal(err)

}

@@ -269,3 +273,42 @@ func guardArmControllers(dataDir string) error {

}

return hostfloor.EnsureControllerDir(dataDir, uid, gid)

}

+// mkdirAllExact is os.MkdirAll with the caller's umask taken out: every

+// directory it creates, and dir itself whether or not it was created, ends

+// with exactly mode. Existing parents keep their modes.

+func mkdirAllExact(dir string, mode os.FileMode) error {

+ var created []string

+ for p := filepath.Clean(dir); ; p = filepath.Dir(p) {

+ if _, err := os.Lstat(p); err == nil {

+ break

+ } else if !os.IsNotExist(err) {

+ return err

+ }

+ created = append(created, p)

+ if parent := filepath.Dir(p); parent == p {

+ break

+ }

+ if err := os.MkdirAll(dir, mode); err != nil {

+ return err

+ }

+ for _, p := range append(created, filepath.Clean(dir)) {

+ if err := os.Chmod(p, mode); err != nil {

+ return err

+ }

+ return nil

+// prepareGuardArmLockDir makes guard-arm's lock directory under

+// <opt>/system without the caller's umask, and repairs <opt>/system itself

+// to 0755: the guard directories sit under the same parent and non-root

+// units exec the guard binary through it, so a umask 077 run must not

+// leave it closed.

+func prepareGuardArmLockDir(optDir, lockDir string) error {

+ if err := mkdirAllExact(filepath.Join(optDir, "system"), 0755); err != nil {

+ return err

+ }

+ return mkdirAllExact(lockDir, 0755)

diff --git a/internal/host/guardarm_mkdir_linux_test.go b/internal/host/guardarm_mkdir_linux_test.go

new file mode 100644

index 000000000..ea2e76eb9

--- /dev/null

+++ b/internal/host/guardarm_mkdir_linux_test.go

@@ -0,0 +1,81 @@

+//go:build linux

+package host

+import (

+ "os"

+ "path/filepath"

+ "syscall"

+ "testing"

+// A umask 077 operator shell must not leave the guard directories closed to

+// the non-root units that exec the guard binary through them.

+func TestMkdirAllExactIgnoresUmask(t *testing.T) {

+ old := syscall.Umask(0o077)

+ defer syscall.Umask(old)

+ root := t.TempDir()

+ if err := os.Chmod(root, 0o700); err != nil {

+ t.Fatal(err)

+ }

+ dir := filepath.Join(root, "system", "guard", "identities")

+ if err := mkdirAllExact(dir, 0o755); err != nil {

+ t.Fatal(err)

+ }

+ for _, p := range []string{filepath.Join(root, "system"), filepath.Join(root, "system", "guard"), dir} {

+ st, err := os.Stat(p)

+ if err != nil {

+ t.Fatal(err)

+ }

+ if st.Mode().Perm() != 0o755 {

+ t.Fatalf("%s is %o, want 755", p, st.Mode().Perm())

+ }

+ if st, _ := os.Stat(root); st.Mode().Perm() != 0o700 {

+ t.Fatalf("an existing parent's mode changed: %o", st.Mode().Perm())

+ }

+ // A directory left 0700 by an earlier run is repaired.

+ if err := os.Chmod(dir, 0o700); err != nil {

+ t.Fatal(err)

+ }

+ if err := mkdirAllExact(dir, 0o755); err != nil {

+ t.Fatal(err)

+ }

+ if st, _ := os.Stat(dir); st.Mode().Perm() != 0o755 {

+ t.Fatalf("existing dir not repaired: %o", st.Mode().Perm())

+ }

+// guard-arm makes its lock directory before the guard directories, under the

+// same <opt>/system parent: neither step may leave that parent closed, and a

+// parent an earlier run left 0700 is repaired.

+func TestGuardArmDirsIgnoreUmaskInOrder(t *testing.T) {

+ old := syscall.Umask(0o077)

+ defer syscall.Umask(old)

+ for _, preexisting := range []bool{false, true} {

+ opt := t.TempDir()

+ if preexisting {

+ if err := os.MkdirAll(filepath.Join(opt, "system"), 0o700); err != nil {

+ t.Fatal(err)

+ }

+ if err := prepareGuardArmLockDir(opt, systemRootDir(opt)); err != nil {

+ t.Fatal(err)

+ }

+ guard := systemGuardDir(opt)

+ for _, dir := range []string{guard, filepath.Join(guard, "identities")} {

+ if err := mkdirAllExact(dir, 0o755); err != nil {

+ t.Fatal(err)

+ }

+ for _, p := range []string{filepath.Join(opt, "system"), systemRootDir(opt), guard, filepath.Join(guard, "identities")} {

+ st, err := os.Stat(p)

+ if err != nil {

+ t.Fatal(err)

+ }

+ if st.Mode().Perm() != 0o755 {

+ t.Fatalf("preexisting=%v: %s is %o, want 755", preexisting, p, st.Mode().Perm())

+ }

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index 13323fdb4..8e68b7dbb 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -925,6 +925,14 @@ func TestPlan14RootReadCensus(t *testing.T) {

if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-claim-untagged-pointer-fix2.tsv"), &inv, true); err != nil {

t.Fatal(err)

}

+ // Census overlay claim-guard-umask (guard-arm's directories ignore the

+ // caller's umask), loaded last, under census-ruling-claim-guard-umask

+ // (platform-1e): RunSystemGuardArm re-pinned at its class F,J4, the new

+ // mkdirAllExact classified G,J4, and the internal/host envelope

+ // re-pinned. It adds no accepted-legacy row, so the seal stands.

+ if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-claim-guard-umask.tsv"), &inv, true); err != nil {

+ t.Fatal(err)

+ }

seal = "53b3cbb6f46d657ce32f49dad84dae79316c80da949ccf37273833eef5c5b2d7"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

diff --git a/internal/provision/testdata/plan14-root-reads-claim-guard-umask.tsv b/internal/provision/testdata/plan14-root-reads-claim-guard-umask.tsv

new file mode 100644

index 000000000..f0d576dab

--- /dev/null

+++ b/internal/provision/testdata/plan14-root-reads-claim-guard-umask.tsv

@@ -0,0 +1,5 @@

+# Census overlay claim-guard-umask (guard-arm's directories ignore the caller's umask; amadan issue drafted 2026-10-19), loaded LAST, after claim-untagged-pointer-fix2. Ruled by platform-1e as census owner: census-ruling-claim-guard-umask.

+# RunSystemGuardArm: the guard and identities directories are now made through mkdirAllExact instead of os.MkdirAll; its read sites are the same files at shifted offsets. mkdirAllExact (new): Lstat walks up only to find which components it creates, then chmods exactly those and the target to 0755. It reads no file content and grants nothing. The seal stands: no accepted-legacy row. No 9B8 entry: it writes no record. prepareGuardArmLockDir (new) has no read site of its own: it repairs <opt>/system to 0755 and makes the lock directory, both through mkdirAllExact.

+@coverage internal/host 2b1aa5edb15838c6b33bf606e0c3c7b05c4931a68b3adef8f384926a5498f64a

+internal/host/guardarm.go RunSystemGuardArm authority F,J4 rev3=census-ruling-claim-guard-umask;identity=carlos system guard-arm, offline CLI uid 0;basis=root guard-arm checks retained census floor before installing guard; no census retains main; policy and identity parse in guardArmInputs, same files read; guard directories, the shared system parent and the lock directory made through mkdirAllExact file:OpenFile@588,file:ReadFile@1595,file:ReadFile@5906,file:ReadFile@888,file:ReadFile@968,file:Stat@3557 23ad7a4d52c3c004f701a937f26b0f58f115b9a007aa7b15446bfa45aacf2b3c

+internal/host/guardarm.go mkdirAllExact authority G,J4 rev3=census-ruling-claim-guard-umask;identity=carlos system guard-arm, offline CLI uid 0;basis=Lstat of the target path and its missing parents only, to choose which directories to create and chmod to 0755; no file content is read file:Lstat@149 d1c988f22c5559ba6765ba9072d3fbbf26fd33836ab672157cb4e1bd9b99aaf3