desktop: helper socket is reachable with mode 0755 before chmod (Endpoint::bind) #363

New issue

Open

opened 2026-11-05 05:08:59 +00:00 by kayg · 0 comments

kayg commented

2026-11-05 05:08:59 +00:00

Owner

Found by J216b while fixing #355 (comment 79225); owner/orchestrator confirmed it is a product bug.

Bug: crates/plugins/desktop/src/socket.rs Endpoint::bind creates desktop.sock with UnixListener::bind (std: bind then listen), so the pathname appears with the umask-derived mode (0755 under umask 022), and only afterwards runs fs::set_permissions(.., 0o600). The client (source_ipc.rs connect_ready, and the old startup loop before it) refuses any socket with group/other bits as PermissionDenied, which ends helper startup. So a client that looks inside that window fails startup spuriously. (The runtime directory is itself 0700, so this is a spurious refusal, not an exposure.) Test fixtures set umask 077, so tests never hit it; the real helper runs under the infraternal agent's umask.

Fix (J216c): bind under a short temporary name, set 0600, listen, then publish with link() (never replaces, so an occupied path still refuses with EEXIST) and unlink the temporary name. desktop.sock first appears already private and listening. A Linux inotify test fails on the current code (it observes IN_ATTRIB on desktop.sock, the chmod after creation) and passes after.

Branch flakes-j216c. Refs #355.

Found by J216b while fixing #355 (comment 79225); owner/orchestrator confirmed it is a product bug. **Bug:** `crates/plugins/desktop/src/socket.rs` `Endpoint::bind` creates `desktop.sock` with `UnixListener::bind` (std: `bind` then `listen`), so the pathname appears with the umask-derived mode (0755 under umask 022), and only *afterwards* runs `fs::set_permissions(.., 0o600)`. The client (`source_ipc.rs` `connect_ready`, and the old startup loop before it) refuses any socket with group/other bits as `PermissionDenied`, which ends helper startup. So a client that looks inside that window fails startup spuriously. (The runtime directory is itself 0700, so this is a spurious refusal, not an exposure.) Test fixtures set umask 077, so tests never hit it; the real helper runs under the infraternal agent's umask. **Fix (J216c):** bind under a short temporary name, set 0600, listen, then publish with `link()` (never replaces, so an occupied path still refuses with EEXIST) and unlink the temporary name. `desktop.sock` first appears already private and listening. A Linux inotify test fails on the current code (it observes `IN_ATTRIB` on `desktop.sock`, the chmod after creation) and passes after. Branch `flakes-j216c`. Refs #355.

kayg referenced this issue

2026-11-05 05:09:08 +00:00

Gate flakes, round 2 #355

kayg referenced this issue

2026-11-05 05:21:22 +00:00

Gate flakes, round 2 #355

kayg referenced this issue

2026-11-05 05:37:56 +00:00

Gate flakes, round 2 #355

kayg referenced this issue

2026-11-05 07:51:17 +00:00

Gate flakes, round 2 #355