Writes follow a static intermediate in-brain directory symlink (brain_update, brain_tunnel, session_log) #173

New Issue

2026-10-05T05:03:27Z

mathias commented

2026-10-05 05:03:27 +00:00

Source: the PR #170 round-2 review (comment 15040), a non-blocking residual. I'm recording it here because #167 covers only a read-side race, and the WriteRegular doc cites #167 for this case.

Residual

brainfs.WriteRegular refuses a final symlink.
os.Root still follows an intermediate directory symlink, as long as it points inside the brain.
So suppose a dir symlink inside wiki/ or knowledge/ points elsewhere in the brain. Then brain_update and brain_tunnel can rewrite an existing .md behind it, for example in raw/. This is a static redirect, not a race.
session_log follows sessions/ itself if that dir is a symlink.

Bounds today

Governance files and .jsonl can't be reached this way, because of the .md/scope rule.
The redirect needs a planted symlink, and the symlinkguard tripwire removes symlinks within 30 s.

Fix

Lstat every prefix component through the root before the write (the realDir pattern from slice 3), or
the fd-relative walk/open from #167.

Done when: a test that writes through wiki/w/alias -> ../../raw is red before the fix and green after, for both brain_update and brain_tunnel, and session_log refuses a symlinked sessions dir.

Created via git-mcp on behalf of @mathias

**Source:** the PR #170 round-2 review (comment 15040), a non-blocking residual. I'm recording it here because #167 covers only a read-side *race*, and the `WriteRegular` doc cites #167 for this case. ## Residual - `brainfs.WriteRegular` refuses a final symlink. - `os.Root` still follows an **intermediate** directory symlink, as long as it points inside the brain. - So suppose a dir symlink inside `wiki/` or `knowledge/` points elsewhere in the brain. Then `brain_update` and `brain_tunnel` can rewrite an existing `.md` behind it, for example in `raw/`. This is a static redirect, not a race. - `session_log` follows `sessions/` itself if that dir is a symlink. ## Bounds today - Governance files and `.jsonl` can't be reached this way, because of the `.md`/scope rule. - The redirect needs a planted symlink, and the symlinkguard tripwire removes symlinks within 30 s. ## Fix - Lstat every prefix component through the root before the write (the `realDir` pattern from slice 3), or - the fd-relative walk/open from #167. **Done when:** a test that writes through `wiki/w/alias -> ../../raw` is red before the fix and green after, for both `brain_update` and `brain_tunnel`, and `session_log` refuses a symlinked sessions dir. --- _Created via git-mcp on behalf of @mathias_

mathias added the risk/high label 2026-10-05 05:03:27 +00:00

mathias referenced this issue

2026-10-05 05:09:13 +00:00

fix: brain_tunnel, brain_update and session_log confine caller-supplied paths (#169) #170

mathias referenced this issue

2026-10-05 05:09:14 +00:00

brain_tunnel: path traversal lets an MCP token holder rewrite any file the pod can write #169

mathias referenced this issue from a commit

2026-10-05 18:47:08 +00:00

fix: brain_tunnel, brain_update and session_log confine caller-supplied paths (#169) (#170)

mathias referenced this issue

2026-10-05 18:51:03 +00:00