mathias/hyperguild
1
0
Fork 0
Code Issues 30 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

symlinkguard ignores FIFOs and other special files: a planted FIFO classification.yaml crash-loops the pod #179

New Issue
Closed
opened 2026-10-05 07:27:39 +00:00 by mathias · 3 comments
mathias commented 2026-10-05 07:27:39 +00:00
Owner
Copy Link
Copy Source

Source: PR #176 review (#157 slice 6), 2026-10-05, verified by running classification.Load.

With #176, classification.Load refuses a non-regular classification.yaml and returns an error, and startup exits on it (cmd/server/main.go, os.Exit(1)). That is the right call: failing open would silently drop explicit tags, some of them stricter than the defaults.

For a symlink, the startup tripwire (startupSymlinkCheck) runs first and removes it. A FIFO, socket or device is not reported, so a FIFO at classification.yaml passes the tripwire and Load exits: a crash loop. Before #176 the pod hung forever in open(2) instead, so this isn't worse. It needs local write access to the pod volume, since Syncthing does not sync FIFOs.

Fix options

  • symlinkguard also reports special files (and removes them, as it does symlinks). This also helps every reader that relies on handle checks.
  • Or Load treats a special file as missing and logs loudly. Not preferred: it is a silent fail-open on the sovereignty config.

Recommended: the first.

Created via git-mcp on behalf of @mathias

**Source:** PR #176 review (#157 slice 6), 2026-10-05, verified by running `classification.Load`. With #176, `classification.Load` refuses a non-regular `classification.yaml` and returns an error, and startup exits on it (`cmd/server/main.go`, `os.Exit(1)`). That is the right call: failing open would silently drop explicit tags, some of them stricter than the defaults. For a **symlink**, the startup tripwire (`startupSymlinkCheck`) runs first and removes it. **A FIFO, socket or device is not reported**, so a FIFO at `classification.yaml` passes the tripwire and Load exits: a crash loop. Before #176 the pod hung forever in `open(2)` instead, so this isn't worse. It needs local write access to the pod volume, since Syncthing does not sync FIFOs. ## Fix options - symlinkguard also reports special files (and removes them, as it does symlinks). This also helps every reader that relies on handle checks. - Or Load treats a special file as missing and logs loudly. Not preferred: it is a silent fail-open on the sovereignty config. Recommended: the first. --- _Created via git-mcp on behalf of @mathias_
mathias commented 2026-10-05 20:48:23 +00:00
Author
Owner
Copy Link
Copy Source

pr-gatekeeper on PR #190 (head f1f975d): BLOCKED. One blocking finding: the persistent-failure alert for a special file that Watch cannot remove has no test. Flipping it out leaves an unremovable FIFO in the brain with zero alerts, and every test stays green. Full review with repros and flip results: #190 (comment)

pr-gatekeeper on PR #190 (head f1f975d): **BLOCKED**. One blocking finding: the persistent-failure alert for a special file that Watch cannot remove has no test. Flipping it out leaves an unremovable FIFO in the brain with zero alerts, and every test stays green. Full review with repros and flip results: https://git.d-ma.be/mathias/hyperguild/pulls/190#issuecomment-15744
mathias commented 2026-10-05 20:53:45 +00:00
Author
Owner
Copy Link
Copy Source

pr-gatekeeper round 2 on PR #190 (head edcfe9e): BLOCKED. B1 is fixed. B2: the new test also passes when the Remove error is swallowed, because the false "removed" alert matches both of its assertions. Review: #190

pr-gatekeeper round 2 on PR #190 (head edcfe9e): **BLOCKED**. B1 is fixed. B2: the new test also passes when the Remove error is swallowed, because the false "removed" alert matches both of its assertions. Review: https://git.d-ma.be/mathias/hyperguild/pulls/190
mathias commented 2026-10-05 21:01:20 +00:00
Author
Owner
Copy Link
Copy Source

pr-gatekeeper round 3 on PR #190 (head e614d39): PASS. B1 and B2 are fixed, and both flips now go red. CI run 9496 is green and task check exits 0. The merge is left to Mathias, because it deploys ingestion. A pre-existing test flake was filed as #193. Review: #190

pr-gatekeeper round 3 on PR #190 (head e614d39): **PASS**. B1 and B2 are fixed, and both flips now go red. CI run 9496 is green and task check exits 0. The merge is left to Mathias, because it deploys ingestion. A pre-existing test flake was filed as #193. Review: https://git.d-ma.be/mathias/hyperguild/pulls/190
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agent/ready
Meets the agent-ready contract; authorizes unattended execution
 blocked/client
Waiting on the client
 blocked/supplier
Waiting on a supplier
 blocked/upstream
Waiting on an upstream project or vendor
 risk/high
Irreversible, security-relevant, or control plane
 risk/low
Reversible, local, test-covered
 risk/medium
Touches shared state, deploys or data
 size/l
Too big - split it
 size/m
Under two days
 size/s
Under half a day
 size/xs
Under an hour
 status:dispatch
status:dispatched
status:review
status:reviewing
type/chore
Maintenance, no behaviour change
 type/decision
Human decision required; never agent/ready
 type/docs
Documentation only
 type/feat
New capability
 type/fix
Corrects broken behaviour
 type/ops
Infrastructure, deploy, runtime
 type/research
Investigate; output is a finding, not code
 type/test
Test coverage only
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate-bot mathias
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mathias/hyperguild#179