fix(organization): accounts config directory checks every ancestor (#1873) #1919

2026-11-11T04:34:52Z

jason.woltje commented

2026-11-11 04:34:52 +00:00

Follow-up to M3 (#1918) and A2's security review P2-1 (#1873): the accounts store checks every ancestor of its config directory.

assertAccountsOwner refused a symlink or non-directory on the config path but checked owner and mode only on the leaf. An ancestor owned by another user, or writable by others without the sticky bit, let that user rename the directory out from under the check and swap in their own accounts.json. Since M3, accounts.json decides who holds root authority on a deployed Console.

New packages/organization/src/config-dir-trust.mjs, assertTrustedConfigDir(configDir, { uid, code }), holding A2's agent-levels rule unchanged: every ancestor belongs to root or this uid and is group or other writable only with the sticky bit; configDir is this uid's and not group or other writable; no symlink anywhere.
assertAccountsOwner and the agent-levels writer both call it, each with its own code (accounts-unsafe, agents-unsafe). Agent-levels messages and check order are unchanged (its 15 tests pass untouched). Every account read and write already went through assertAccountsOwner: load, lock, locked writer, mosaic accounts verbs including init, webui stamp check and SSO reloads.
Two leaf refusals no longer quote a path (redaction rule, #1916). A missing config directory now refuses accounts-unsafe: config directory is missing instead of a raw ENOENT.
Old-path re-export at packages/business/src/config-dir-trust.mjs, as rename-b-identity requires.

Shipped layouts pass: ~/.config/mosaic-NAME under a user-owned home, and Case 2's /srv/mosaic/.config/mosaic-dev (root 0755 ancestors, mosaic 0700 home, .config 0755 from case2-install.sh). A group-writable .config without the sticky bit now refuses; that is the rule, on purpose.

Tests: 0777 parent and grandparent refuse load, init and lock with nothing created; 1777 passes; another uid refuses; symlinked ancestor refuses; no refusal contains the sk-test-NOT-A-SECRET-1234 path component or a /. CLI init, list and user remove exit 3 under a 0777 ancestor. All new tests fail on base.

Lane: Opus. Gate on d0cfebe28: 275 files (organization, plus every cli and webui importer of accounts, sso and agent-levels-write) and test-config, 2490/0. Security review daybreak-blue: approve, no findings.

Deferred: util.mjs readJsonFile still quotes the file path for a missing, symlinked or invalid accounts.json. Follow-up after the refusal-names change lands.

Follow-up to M3 (#1918) and A2's security review P2-1 (#1873): the accounts store checks every ancestor of its config directory. `assertAccountsOwner` refused a symlink or non-directory on the config path but checked owner and mode only on the leaf. An ancestor owned by another user, or writable by others without the sticky bit, let that user rename the directory out from under the check and swap in their own `accounts.json`. Since M3, `accounts.json` decides who holds root authority on a deployed Console. - New `packages/organization/src/config-dir-trust.mjs`, `assertTrustedConfigDir(configDir, { uid, code })`, holding A2's agent-levels rule unchanged: every ancestor belongs to root or this uid and is group or other writable only with the sticky bit; configDir is this uid's and not group or other writable; no symlink anywhere. - `assertAccountsOwner` and the agent-levels writer both call it, each with its own code (`accounts-unsafe`, `agents-unsafe`). Agent-levels messages and check order are unchanged (its 15 tests pass untouched). Every account read and write already went through `assertAccountsOwner`: load, lock, locked writer, `mosaic accounts` verbs including `init`, webui stamp check and SSO reloads. - Two leaf refusals no longer quote a path (redaction rule, #1916). A missing config directory now refuses `accounts-unsafe: config directory is missing` instead of a raw ENOENT. - Old-path re-export at `packages/business/src/config-dir-trust.mjs`, as `rename-b-identity` requires. Shipped layouts pass: `~/.config/mosaic-NAME` under a user-owned home, and Case 2's `/srv/mosaic/.config/mosaic-dev` (root 0755 ancestors, mosaic 0700 home, `.config` 0755 from `case2-install.sh`). A group-writable `.config` without the sticky bit now refuses; that is the rule, on purpose. Tests: 0777 parent and grandparent refuse load, init and lock with nothing created; 1777 passes; another uid refuses; symlinked ancestor refuses; no refusal contains the `sk-test-NOT-A-SECRET-1234` path component or a `/`. CLI `init`, `list` and `user remove` exit 3 under a 0777 ancestor. All new tests fail on base. Lane: Opus. Gate on d0cfebe28: 275 files (organization, plus every cli and webui importer of accounts, sso and agent-levels-write) and test-config, 2490/0. Security review daybreak-blue: approve, no findings. Deferred: `util.mjs` `readJsonFile` still quotes the file path for a missing, symlinked or invalid `accounts.json`. Follow-up after the refusal-names change lands.

jason.woltje added 2 commits 2026-11-11 04:34:52 +00:00

fix(organization): accounts config directory checks every ancestor (#1873 ) 930182b54a

assertAccountsOwner refused a symlink or non-directory on the config path,
but checked owner and mode only on the leaf. An ancestor owned by another
user, or writable by others without the sticky bit, let that user rename the
directory away and put their own accounts.json in its place. Since M3 that
file decides root authority on a deployed Console.

One shared helper, config-dir-trust.mjs, now holds A2's rule: every ancestor
belongs to root or this uid and is group or other writable only with the
sticky bit; configDir itself is this uid's and not group or other writable.
The accounts store (load, init, lock, locked write, mosaic accounts) and the
root agent file's writer both call it, each with its own refusal code. A2's
messages are unchanged.

Accounts refusals no longer quote a path: the config directory and accounts
file uid messages name the rule and the uid only (redaction rule, #1916).
A missing config directory now refuses accounts-unsafe instead of a raw
ENOENT.

fix(organization): old-path re-export for config-dir-trust.mjs (#1873 ) 57052c53dd

rename-b-identity requires one packages/business/src shim per
packages/organization/src module.

jason.woltje merged commit 57052c53dd into refactor

2026-11-11 04:34:56 +00:00

jason.woltje referenced this pull request

2026-11-11 05:39:58 +00:00

fix(refusals): name validated identifiers the system already shows (#1873) #1920

jason.woltje referenced this pull request

2026-11-11 05:43:57 +00:00

docs(run-sheet): check config directory ancestors before accounts init (#1873) #1922

jason.woltje referenced this issue from a commit

2026-11-11 05:43:57 +00:00

docs(run-sheet): check config directory ancestors before accounts init (#1873)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1919