Skip to content

v3.18.2 - sweep-marker symlink hardening

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Aug 05:39
· 100 commits to main since this release
v3.18.2
This tag was signed with the committer’s verified signature.
HetCreep HetCreep
SSH Key Fingerprint: 0osv9sipbbl2qmrI00rRA3kcEKs4ZuS+FBihPD/c8DU
Verified
Learn about vigilant mode.
1b614e4
This commit was signed with the committer’s verified signature.
HetCreep HetCreep
SSH Key Fingerprint: 0osv9sipbbl2qmrI00rRA3kcEKs4ZuS+FBihPD/c8DU
Verified
Learn about vigilant mode.

Hardens the rot-canary sweep marker so a planted symlink can no longer redirect it.

Security

rot-canary Stop hook: the tmp-sweep throttle marker no longer writes through a planted symlink (CWK-031/U8, CoalBoard nasa-L3 round). The 24h throttle marker sat flat in the shared tmp root under a fixed name, written with the default w flag, which follows a symlink at the destination. On Unix the shared /tmp let any local user pre-plant a link at that name; the victim next Stop truncated the link target (truncate-to-empty / empty-file creation, not arbitrary content).

Fixed by moving the marker into the private os.tmpdir()/coalmine/ subdir (mode 0700 + the lstat dir guard) and re-stamping via a per-pid temp + rename rather than a plain write. A symlink at the marker path is never obeyed as a gate, so it cannot suppress the sweep either.

Full detail: CHANGELOG.md [3.18.2].

Full Changelog: v3.18.1...v3.18.2

Assets 12
Loading