Repository navigation
fix(ingestor): stats .tmp writer follows a hard link to another file of the ingestor's user #228
Description
Activity
Additional items for the same code, from the round-2 re-review of #216 (merged). Please handle them together with the hard-link fix:
- FIFO tests without a release guard.
- The FIFO subtest of
TestStatsWriteErrorNamesThePathOnce_160callswriteStatsAtomicdirectly. TestStatsFileWriterFailureLineNamesThePathOnce_160callsstop()unguarded.- If fix(ingestor): a FIFO at the stats .tmp path blocks the stats writer forever #161 regressed (e.g.
O_NONBLOCKdropped), both would hang until the package timeout instead of failing in seconds. - Route them through
writeStatsAtomicOrReleaseand a guarded stop.
- The FIFO subtest of
- The rename failure path is untested. A mutant that stops stripping the
*os.LinkErrorsurvives. Add a rename-failure case toTestStatsWriteErrorNamesThePathOnce_160, such as a non-empty directory at the destination. - DRY. The owner detail and hint (
owned by uid %d, ingestor uid %d/remove it or fix its owner) are built in bothsetPermissionHintandcheckStatsTmpOwner. Extract one helper.
- FIFO tests without a release guard.
- added a commit that references this issue
on Oct 5, 2026 Fixed by #240 (merged as
e0bfe955).- The stats writer refuses a
.tmpwhoseFstatshowsnlink > 1and leaves it in place. The check uses the open descriptor, so the link target is never changed and nothing is published. - The fix(ingestor): rate-limited stats tmp errors, FIFO-safe writer, stale status (#160, #161) #216 follow-ups are done:
- the FIFO tests run through the release guard, so they fail fast instead of hanging;
- the rename failure path is tested;
- one helper builds the owner/permission hint.
- The stats writer refuses a
Relates to #160, #161, #216
Problem
A hard link at
<stats path>.tmpthat points to another file owned by the ingestor's user passes the regular-file and owner checks inwriteStatsAtomic. The writer then truncates that file, overwrites it with the stats JSON, and the rename publishes it./tmp), and withfs.protected_hardlinks=1also access to the target.Proposed fix
Fstatshowsnlink > 1, and leave it in place.statsWriteErrorshape, e.g.<tmp>: hard-linked (nlink N); remove it.Acceptance