cloud credential transfer tests fail on macOS: secure_directory O_NOFOLLOW ancestor walk rejects symlinked TMPDIR (/var -> /private/var) #1947

Activity

1. 1jehuang

   added

   bugSomething isn't workingSomething isn't working

   triage: needs-decisionNeeds maintainer decision/design thoughtNeeds maintainer decision/design thought

   securitySecurity hardening or security-sensitive changes.Security hardening or security-sensitive changes.

   platform: macosmacOS-specific behavior or compatibility.macOS-specific behavior or compatibility.

   on Oct 24, 2026
2. 1jehuang commented on Oct 24, 2026

   

   1jehuang

   on Oct 24, 2026

   Owner

   More actions

   Thanks for the clear macOS reproduction. This is security-sensitive credential-path validation, so I will not replace the no-follow walk with canonicalization without reviewing the trust boundary and symlink/rename race cases. Recommended next step: define which OS-managed ancestor aliases are permitted, retain descriptor-relative validation of the private store, and verify both default macOS TMPDIR and hostile-symlink cases. Leaving this open for that review.

   ---

   Jcode agent (automated triage), on behalf of @1jehuang
3. ianalitis commented on Oct 25, 2026

   

   ianalitis

   on Oct 25, 2026

   Contributor

   More actions

   Reproduced on current master (4bb16b96c), macOS 26 arm64 (Darwin 25.6.0).

   Same counts as reported, from the same binary, changing only TMPDIR:

   $ TMPDIR=/Users/ianalitis/.jcode/scratch ./jcode_base auth::transfer
   test result: ok. 22 passed; 0 failed; ...
   
   $ TMPDIR=/var/folders/_4/.../T/ ./jcode_base auth::transfer
   test result: FAILED. 5 passed; 17 failed; 0 ignored

   Failure shape is uniform:

   thread 'auth::transfer::tests::cloud_handoff_replaces_stale_rotated_copy_but_not_other_identity' panicked at
   crates/jcode-base/src/auth/transfer.rs:1277:73:
   called `Result::unwrap()` on an `Err` value: UnsafePath
   

   Cause is where the report says it is: secure_directory (crates/jcode-base/src/auth/transfer.rs:479) walks from / to the target with O_NOFOLLOW | O_DIRECTORY, and rejects the first ancestor that is not a real directory. On macOS /var is a symlink to /private/var, so every descendant of the default TMPDIR is rejected before the target is ever opened. With TMPDIR=/tmp the same thing happens (/tmp -> /private/tmp), which confirms it is the ancestor prefix, not the leaf.

   So this is not a flaky test: it is the security check rejecting a path shape that every standard macOS user has. CI macOS stays green only because the runner's HOME/TMPDIR have no symlinked ancestors, which means the suite is effectively not exercising the check on the platform users run.

   Left triage: needs-decision because fixing it is a policy choice about what the walk should permit, not a mechanical patch. Three options, roughly:

   1. Canonicalize each ancestor before comparing, and keep O_NOFOLLOW on the final open only. Preserves the "do not follow a symlink into the target" property while accepting vendor path shapes.
   2. Walk only real directories under HOME and require HOME itself to be canonical and owned by the current user, treating the TMPDIR prefix as trusted above that point.
   3. Keep the strict walk and change the tests to build their own symlink-free scratch root. Cheapest, but leaves jcode refusing a standard macOS TMPDIR at runtime, so it hides the user-visible behavior rather than fixing it.

   Option 1 is the one that matches the intent documented in the code; option 3 would make the tests pass while shipping the same runtime rejection. Happy to implement whichever is chosen.

   ---

   — Jcode agent (automated triage), on behalf of @1jehuang