fix(global): validate dns helper path before install#47
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ade090902b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const parentPathsSecure = await verifyMacRootControlledPaths([ | ||
| dirname(dirname(MAC_DNS_RECOVERY_HELPER_PATH)), | ||
| dirname(MAC_DNS_RECOVERY_HELPER_PATH), | ||
| ]); |
There was a problem hiding this comment.
This preflight check now requires dirname(MAC_DNS_RECOVERY_HELPER_PATH) to already exist, but globalAuthorize later runs sudo install -d ... /usr/local/libexec specifically to create that directory when needed. On machines where /usr/local/libexec is missing, readMacOwnershipAndMode returns null, verifyMacRootControlledPaths fails, and authorization exits early even though the subsequent privileged create step would have succeeded; that regresses fresh macOS setups and blocks DNS helper installation.
Useful? React with 👍 / 👎.
## 2.5.0 (2026-04-07) * test: add env matrix coverage and PR verification guardrails ([6d63ef1](6d63ef1)) * test(global): mock macOS trust roots in CI fixtures ([3550a2e](3550a2e)) * Merge branch 'main' into fix/host-runtime-ca-trust ([e4feec9](e4feec9)) * Merge branch 'main' into skill-progression-map ([b2e87c6](b2e87c6)) * Merge pull request #43 from hack-dance/fix/host-runtime-ca-trust ([be98476](be98476)), closes [#43](#43) * Merge pull request #44 from hack-dance/skill-progression-map ([031991c](031991c)), closes [#44](#44) * Merge pull request #45 from hack-dance/fix/host-runtime-ca-trust ([1e966f5](1e966f5)), closes [#45](#45) * Merge pull request #46 from hack-dance/fix/dns-helper-hardening ([e3fca8a](e3fca8a)), closes [#46](#46) * Merge pull request #47 from hack-dance/fix/dns-helper-preflight-order ([8850b5c](8850b5c)), closes [#47](#47) * fix(env): clarify host command env inspection ([3c10f3b](3c10f3b)) * fix(global): allow missing libexec during preflight ([dc2e15a](dc2e15a)) * fix(global): harden dns recovery helper authorization ([fa4bb7e](fa4bb7e)) * fix(global): invalidate sudo cache before verifying dns auth ([9eeca18](9eeca18)) * fix(global): limit host bundle to macos roots ([bd2c074](bd2c074)) * fix(global): preserve brew fallback around dns helper ([7e5044b](7e5044b)) * fix(global): refresh dns recovery sudoers rule ([6cfe755](6cfe755)) * fix(global): retry brew when dns helper is stale ([f63067f](f63067f)) * fix(global): retry brew when helper stop fails ([2c6fa83](2c6fa83)) * fix(global): skip host tls env when trust is declined ([7cbd139](7cbd139)) * fix(global): use a root-owned dns recovery helper ([d9abbb5](d9abbb5)) * fix(global): validate dns helper path before install ([ade0909](ade0909)) * fix(runtime): cover compose-target host trust fallback ([a8044ef](a8044ef)) * fix(runtime): preserve explicit host TLS env ([3f1c928](3f1c928)) * fix(runtime): tighten host trust env typing ([2ac7b51](2ac7b51)) * fix(runtime): trust local hack CA for host workflows ([bdab2bd](bdab2bd)) * feat(doctor): repair host tls trust drift ([7da28f5](7da28f5)) * feat(env): add shell mode for host env commands ([7337d59](7337d59))
1 participant
Summary
/usr/localand/usr/local/libexecsecurity before any privileged helper writeVerification