security: harden provider evidence directory

[seonghobae]

Purpose

Fail closed before provider synchronization evidence is created under a Unix directory writable by group or other principals. Provider evidence can later participate in source-eviction authority, so the local durable evidence root must not be replaceable or writable by unrelated principals.

Exact current state

• Exact source head: acc09e1434985af4ac266ad60bb37dbc23882aa5.
• Independently resolved live protected main: be418bac9bfbdc8aa41b1a698713833e3dbccfdc.
• Fresh main -> head comparison is ahead, ahead_by = 12, behind_by = 0, with merge base exactly equal to live protected main.
• The semantic delta is exactly src-tauri/src/provider_evidence.rs plus src-tauri/tests/provider_evidence_directory_authority.rs.
• Exact-head native workflows are green: Test 31584579943, Release 31584579944, Security Scan 31584579913, and SAST Semgrep 31584579905 all completed successfully.
• Formal CodeRabbit review evidence is COMMENTED on predecessor head 66e3432f01c5e8bd16065038e5c4b8103968ecc6; its sole semantic nitpick was that a 0777 fixture did not independently prove group-write and other-user-write rejection. Current head addresses that exact finding with separate 0o020 and 0o002 cases. Review threads are currently empty. Predecessor review evidence does not transfer as current-head approval.
• The PR remains Draft because repository-wide exact 100% owned-production coverage is still unsatisfied on canonical coverage owner ci: require exact-head production coverage evidence #156. Native workflow success does not waive that product-quality requirement.

Test-first repair

The regression calls production write_immutable_sync_evidence with valid provider evidence under two independently unsafe real temporary-directory modes:

1. owner-private plus group write (0o720); and
2. owner-private plus other-user write (0o702).

Each case requires stable provider-evidence-directory-writable-by-others refusal and zero evidence files created. The production writer rejects Unix directory mode & 0o022 != 0, creates the evidence file owner-read-only with OpenOptionsExt::mode(0o400) at create_new, and performs post-write hardening through the already-open file with file.set_permissions(...) rather than re-resolving its pathname. Existing non-directory, symlink, bounded-size, create-once, fsync, and integrity behavior remains intact.

Scope / non-duplication

This protects only the durable provider-evidence authority root. Protected main separately hardens private-evidence parents and other cloud boundaries. #181 owns cloud-review decisions, #182 cloud-eviction authority records, #186 cloud-copy receipts, #174 generic cleanup, #156 repository-wide exact coverage, #150 Podman desktop evidence, and #149 canonical acquisition documentation. No other active line is imported here.

Required before merge

Keep Draft until the unchanged exact head satisfies every live required workflow, repository-wide exact 100% owned-production coverage without exclusions or threshold weakening, all valid current-head findings are addressed, and fresh live-base ancestry remains current. Pending, queued, skipped-required, failed, stale, predecessor, model-only, status-only, rate-limited, or synthetic evidence is not passing.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4dac2e45-31c8-42b9-bab9-f10a1e7b2937

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Unix 환경에서 provider evidence 디렉터리의 그룹 및 기타 사용자 쓰기 권한을 검사합니다. 권한이 있으면 지정된 오류를 반환하고 evidence 파일을 생성하지 않습니다. 해당 동작을 검증하는 회귀 테스트를 추가했습니다.

Changes

Provider evidence 디렉터리 권한

Layer / File(s)	Summary
디렉터리 권한 검증과 회귀 테스트 src-tauri/src/provider_evidence.rs, src-tauri/tests/provider_evidence_directory_authority.rs	Unix에서 권한 비트 0o022를 검사합니다. 그룹 또는 기타 사용자에게 쓰기 권한이 있으면 provider-evidence-directory-writable-by-others 오류를 반환합니다. 회귀 테스트는 evidence 파일이 생성되지 않는지 확인합니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ContextualWisdomLab/disksage#175: 다른 evidence writer에서 Unix 그룹 및 기타 사용자 쓰기 가능 디렉터리를 거부하는 변경입니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 provider evidence 디렉터리의 보안 강화라는 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/provider-evidence-directory-authority-v1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

🧹 Nitpick comments (1)

src-tauri/tests/provider_evidence_directory_authority.rs (1)

11-17: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

그룹 쓰기와 기타 사용자 쓰기를 별도로 검증하세요.

현재 테스트는 0o777만 사용합니다. 이 값은 두 쓰기 비트를 동시에 설정합니다. 구현이 한 비트만 검사하도록 회귀해도 테스트가 통과할 수 있습니다. 0o020과 0o002를 각각 사용하는 케이스를 추가하세요.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src-tauri/tests/provider_evidence_directory_authority.rs` around lines 11 -
17, Update the provider evidence permission regression test setup around the
temporary directory to validate group-write and other-user-write independently.
Add separate cases using 0o020 and 0o002 rather than relying only on 0o777,
while preserving the existing permission-setting and assertion behavior for each
case.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src-tauri/tests/provider_evidence_directory_authority.rs`:
- Around line 11-17: Update the provider evidence permission regression test
setup around the temporary directory to validate group-write and
other-user-write independently. Add separate cases using 0o020 and 0o002 rather
than relying only on 0o777, while preserving the existing permission-setting and
assertion behavior for each case.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5242cd6e-63c2-4aa2-8f60-c3c860c367b4

📥 Commits

Reviewing files that changed from the base of the PR and between 4547503 and 66e3432.

📒 Files selected for processing (2)

• src-tauri/src/provider_evidence.rs
• src-tauri/tests/provider_evidence_directory_authority.rs

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

Please review the unchanged exact head acc09e1434985af4ac266ad60bb37dbc23882aa5. The predecessor-head nitpick is addressed by independent 0o020 and 0o002 regression cases; predecessor review evidence is not being transferred.

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 22 minutes and 35 seconds before sending another message.

[seonghobae]

@coderabbitai review

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 10 minutes and 5 seconds before sending another message.

[seonghobae]

@OpenCode review current head c233f89. Re-evaluate provider-evidence authority findings against this exact head.

[seonghobae]

@OpenCode review current head $(git rev-parse --short HEAD). Fixed the exact macOS E0617 variadic-FFI mode argument in private evidence publication with libc::c_uint; no other behavior changed.

[seonghobae]

@OpenCode review current head 9ef9b1b. Fixed the exact macOS E0617 variadic-FFI mode argument in private evidence publication with libc::c_uint; no other behavior changed.

[seonghobae]

@OpenCode review current head 9ef9b1b. The current regression test independently exercises 0o020 and 0o002 shared-write bits; stale CodeRabbit advice from the older 0o777-only test is addressed. Please re-evaluate this exact head.

Dismissing: this REQUEST_CHANGES was posted against commit acc09e1 where coverage-evidence failed. The PR's current head has coverage-evidence passing (verified via gh pr checks). No unresolved review threads remain. Re-request review to re-validate.