{"version":"2.1.274","anchor":"directory-descent-symlinkmount-verification-hardened-agains","canonical_anchor":"directory-descent-symlinkmount-verification-hardened-agains","heading":"Directory-descent symlink\/mount verification hardened against races and EPERM\/EACCES","tier":"notice","area":"Filesystem Security","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274\/e\/directory-descent-symlinkmount-verification-hardened-agains","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274","markdown":"### Directory-descent symlink\/mount verification hardened against races and EPERM\/EACCES\n\nSymlink and mount checks while walking into directories are hardened against races and permission errors\n\n**What**\n\nWhen Claude Code verifies that a file path's parent directories are what they're expected to be (checking they haven't been swapped out for a symlink, for example), it now walks the path one directory level at a time, re-verifying each level even if the normal file-status check fails with a permission error. As a fallback, it opens the directory directly with a flag that refuses to follow symlinks, in order to check it safely.\n\n**Why**\n\nThis closes a race-condition window (called TOCTOU, time-of-check to time-of-use) where a symlink could be swapped in partway through a path check, and it makes the check more robust on systems where permission errors would otherwise have blocked verification entirely.\n\n- Area: Filesystem Security\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}