Internal write atomicity now includes inode-level identity checks on sandbox staging directories, rejecting writes if the directory was replaced or moved after being established by a sandboxed command.
Details
- When a sandboxed command first opens a staging directory (
qIs), the directory'sdev(device number) andino(inode number) are recorded in an in-process map alongside a held open file descriptor (usingO_RDONLY | O_DIRECTORY | O_NOFOLLOWto prevent symlink traversal) - Before each subsequent atomic write,
FDt()re-opens the directory with the same flags, callsfstatSync, and compares the livedev/inopair against the recorded values; a mismatch (directory removed and recreated, or replaced by a symlink) triggers_Ie(), which throwsStagingDirTamperedErrorand emits asandbox_exec/atomic_write_staging_dir_tamperedtelemetry event - A separate path (
zIs) checks the parent of the staging dir: if the parent resolves to a symlink (ELOOP) or non-directory (ENOTDIR), aSymlinkWriteRefusedErroris thrown with"Refusing to stage atomic write under non-directory parent: <path>" - If the staging dir itself becomes ENOENT/ENOTDIR/ELOOP between establishment and write-time, the write falls back to a sibling path in the same directory rather than silently using a potentially hostile target
StagingDirTamperedErroris included in the harness's set of named sentinel error types reported to telemetry
Evidence
Error class (search for "StagingDirTamperedError"); inode comparison (r.dev !== t.dev || r.ino !== t.ino); throw site _Ie() (search for "Refusing to stage atomic write under non-directory parent")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.