fix(global): harden dns recovery helper authorization#46
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fa4bb7e21b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const helperSecurityOk = await verifyMacDnsRecoveryHelperSecurity(); | ||
| if (!helperSecurityOk) { |
There was a problem hiding this comment.
globalAuthorize installs /usr/local/libexec/hack-dns-recovery first and only then runs verifyMacDnsRecoveryHelperSecurity(). In the exact scenario this new guard is meant to reject (for example, /usr/local not root-controlled), the command returns 1 after privileged writes have already happened, leaving a partial helper install in an insecure location and inconsistent state for later flows that gate on helper existence. The parent-path ownership/mode checks should run before helper installation (or the helper should be removed on failure).
Useful? React with 👍 / 👎.
## 2.5.0 (2026-04-07) * test: add env matrix coverage and PR verification guardrails ([6d63ef1](6d63ef1)) * test(global): mock macOS trust roots in CI fixtures ([3550a2e](3550a2e)) * Merge branch 'main' into fix/host-runtime-ca-trust ([e4feec9](e4feec9)) * Merge branch 'main' into skill-progression-map ([b2e87c6](b2e87c6)) * Merge pull request #43 from hack-dance/fix/host-runtime-ca-trust ([be98476](be98476)), closes [#43](#43) * Merge pull request #44 from hack-dance/skill-progression-map ([031991c](031991c)), closes [#44](#44) * Merge pull request #45 from hack-dance/fix/host-runtime-ca-trust ([1e966f5](1e966f5)), closes [#45](#45) * Merge pull request #46 from hack-dance/fix/dns-helper-hardening ([e3fca8a](e3fca8a)), closes [#46](#46) * Merge pull request #47 from hack-dance/fix/dns-helper-preflight-order ([8850b5c](8850b5c)), closes [#47](#47) * fix(env): clarify host command env inspection ([3c10f3b](3c10f3b)) * fix(global): allow missing libexec during preflight ([dc2e15a](dc2e15a)) * fix(global): harden dns recovery helper authorization ([fa4bb7e](fa4bb7e)) * fix(global): invalidate sudo cache before verifying dns auth ([9eeca18](9eeca18)) * fix(global): limit host bundle to macos roots ([bd2c074](bd2c074)) * fix(global): preserve brew fallback around dns helper ([7e5044b](7e5044b)) * fix(global): refresh dns recovery sudoers rule ([6cfe755](6cfe755)) * fix(global): retry brew when dns helper is stale ([f63067f](f63067f)) * fix(global): retry brew when helper stop fails ([2c6fa83](2c6fa83)) * fix(global): skip host tls env when trust is declined ([7cbd139](7cbd139)) * fix(global): use a root-owned dns recovery helper ([d9abbb5](d9abbb5)) * fix(global): validate dns helper path before install ([ade0909](ade0909)) * fix(runtime): cover compose-target host trust fallback ([a8044ef](a8044ef)) * fix(runtime): preserve explicit host TLS env ([3f1c928](3f1c928)) * fix(runtime): tighten host trust env typing ([2ac7b51](2ac7b51)) * fix(runtime): trust local hack CA for host workflows ([bdab2bd](bdab2bd)) * feat(doctor): repair host tls trust drift ([7da28f5](7da28f5)) * feat(env): add shell mode for host env commands ([7337d59](7337d59))
1 participant
Summary
root:wheelownership when installing the dns recovery helper and sudoers file/usr/local,/usr/local/libexec, and the helper path are root-controlled before enabling passwordless sudobrewpath in the helper and add regression tests for both security casesVerification