{"version":"2.1.198","anchor":"atomic-write-staging-dir-tamper-detection","canonical_anchor":"atomic-write-staging-dir-tamper-detection","heading":"Atomic Write Staging Dir Tamper Detection","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.198\/e\/atomic-write-staging-dir-tamper-detection","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.198","markdown":"### Atomic Write Staging Dir Tamper Detection\n\nInternal write atomicity now includes inode-level identity checks on sandbox staging directories, rejecting writes if the directory was replaced or moved after being established by a sandboxed command.\n\n**Details**\n\n- When a sandboxed command first opens a staging directory (`qIs`), the directory's `dev` (device number) and `ino` (inode number) are recorded in an in-process map alongside a held open file descriptor (using `O_RDONLY | O_DIRECTORY | O_NOFOLLOW` to prevent symlink traversal)\n- Before each subsequent atomic write, `FDt()` re-opens the directory with the same flags, calls `fstatSync`, and compares the live `dev`\/`ino` pair against the recorded values; a mismatch (directory removed and recreated, or replaced by a symlink) triggers `_Ie()`, which throws `StagingDirTamperedError` and emits a `sandbox_exec` \/ `atomic_write_staging_dir_tampered` telemetry event\n- A separate path (`zIs`) checks the parent of the staging dir: if the parent resolves to a symlink (ELOOP) or non-directory (ENOTDIR), a `SymlinkWriteRefusedError` is thrown with `\"Refusing to stage atomic write under non-directory parent: <path>\"`\n- If the staging dir itself becomes ENOENT\/ENOTDIR\/ELOOP between establishment and write-time, the write falls back to a sibling path in the same directory rather than silently using a potentially hostile target\n- `StagingDirTamperedError` is included in the harness's set of named sentinel error types reported to telemetry\n\n**Evidence**\n\nError class (search for `\"StagingDirTamperedError\"`); inode comparison (`r.dev !== t.dev || r.ino !== t.ino`); throw site `_Ie()` (search for `\"Refusing to stage atomic write under non-directory parent\"`)"}