Refuse secret key/token writes through a planted dest symlink

[cursor]

Problem

write_key_file (setup wizard / set_search_api_key) and admin-token generate (arbiter --api) opened the dest with open(O_WRONLY|O_CREAT|O_TRUNC). That follows a symlink. A planted ~/.arbiter/openrouter_api_key, search_api_key, or admin_token → elsewhere link was truncated with the secret. Reproduced: admin_token → secret.txt left the victim as adm_LEAKED_TOKEN.

Path chmod(0600) after close had the same follow-the-link hole. A planted FIFO could hang the wizard / --api startup or deliver the secret to a waiting reader.

Fix

Shared write_secret_file opens with O_WRONLY|O_CREAT|O_TRUNC|O_NOFOLLOW|O_CLOEXEC|O_NONBLOCK, fstats a regular file, fchmod(0600) (no path chmod), writes with EINTR retry, and fsyncs. Isolated new helper used by write_key_file and resolve_admin_token.

Tests

unit_secret_file — create 0600 file, overwrite + tighten 0644, planted dest symlink does not clobber the target (victim stays do-not-clobber), planted FIFO refused without hanging, directory dest refused. 5/5 locally (18 assertions) ×3 + ASan + UBSan + TSan. arbiter compiles.

Independently mergeable against main (0456350). git merge-tree --write-tree vs main, #321, #323, #326, #339, #342, #343, #344, #351, #354–#364 CLEAN. Does not overlap #363 (atomic_file tmp staging) or #364 (MCP registry tmp). CHANGELOG [Unreleased] is the usual sibling note.

  

---

Note

High Risk
Changes how API keys and admin tokens are persisted; incorrect open flags or validation could break setup/--api startup or leave secrets writable via symlink tricks.

Overview
Fixes a local symlink/FIFO exfiltration hole when arbiter writes secrets under ~/.arbiter/. Setup wizard API-key saves (write_key_file) and fresh admin token generation on arbiter --api no longer use open(O_CREAT|O_TRUNC) (which followed a planted dest symlink) or post-close chmod on the path.

A shared write_secret_file helper opens with O_NOFOLLOW|O_NONBLOCK, requires a regular file via fstat, sets mode 0600 with fchmod, writes with retry/fsync, and fails closed on symlink, FIFO, or directory destinations. unit_secret_file covers create/overwrite, symlink non-clobber, FIFO no-hang, and directory refusal. CHANGELOG [Unreleased] documents the behavior.

^{Reviewed by Cursor Bugbot for commit bf38a8c. Bugbot is set up for automated code reviews on this repo. Configure here.}