security: bind private evidence publication to directory identity

[seonghobae]

Purpose

Bind the shared private_evidence create-once writer to the exact private directory object that was authorized, rather than to a pathname that a same-user actor can replace after validation.

Exact current state

• stacked base security: bind Brew cleanup audit records to private storage #187 exact head: 8d1733849884bc517171e44065e1219568120e66
• exact current head: 18c99bc131965422c01011bc8949ccca120a1d59
• fresh base-to-head comparison is ahead-only and preserves exactly two semantic files: src-tauri/src/private_evidence.rs plus src-tauri/tests/private_evidence_umask.rs
• exact Test 32320053074 and Release 32320053258 are queued; predecessor evidence does not transfer
• prior CodeRabbit umask finding is resolved in the current source and its review thread is resolved
• PR remains Draft

Test-first security repair

The implementation opens the authorized parent with Unix no-follow directory semantics; validates opened-directory device/inode identity and private permissions against the current pathname before creation, after the deterministic pre-create seam, and before success; creates the record descriptor-relative with openat(O_CREAT | O_EXCL | O_NOFOLLOW); normalizes the already-opened record to exact mode 0600 so restrictive umasks cannot create a permanent unreadable tombstone; writes/fsyncs the exact file descriptor and fsyncs the opened parent; and verifies final parent and returned-path record identity against the opened objects.

On post-create publication failure it does not unlink by pathname, because a same-user process may already have replaced that name. It truncates and syncs only the exact open record descriptor, leaving at most a zero-length mode-0600 tombstone in the authorized directory for explicit cleanup. Source-root exclusion, size bounds, create-new semantics, privacy flags, SHA-256 receipt, and explicit non-Unix fail-closed behavior remain intact.

The branch was advanced non-destructively onto current #187. Current base-to-head comparison proves protected-main package movement did not leak into this security edge.

Required before merge

Keep Draft until the unchanged exact head passes every applicable native and central workflow, exact repository-wide 100% owned-production coverage, zero valid unresolved findings, current stack/base ancestry, package/SBOM/provenance requirements where applicable, and live independent-review governance. Pending, queued, skipped-required, cancelled, absent, neutral-required, failed, stale, predecessor, synthetic, status-only, model-only, diagnostic-only, or author-only evidence is non-passing.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cd5755f4-8f1e-46b1-ac60-c32c9bbaed71

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Unix 증거 저장 로직이 경로 기반 생성에서 디렉터리 디스크립터와 openat 기반 생성으로 변경되었습니다. 부모 디렉터리와 파일의 권한 및 동일성을 재검증하고, 검증 실패 시 파일을 삭제하지 않고 0바이트로 무효화합니다. 관련 경쟁 상태 테스트가 추가되었습니다.

Changes

Unix 증거 파일 생성

Layer / File(s)	Summary
디렉터리 디스크립터 기반 파일 생성 src-tauri/src/private_evidence.rs	부모 디렉터리를 열고 권한과 device/inode 동일성을 반복 검증합니다. openat으로 0600, O_EXCL, O_NOFOLLOW 파일을 원자적으로 생성합니다. 생성 후 파일과 디렉터리를 동기화하고 최종 객체 동일성을 확인합니다. 검증 실패 시 열린 파일을 0바이트로 만든 뒤 동기화합니다.
경쟁 상태 검증 테스트 src-tauri/src/private_evidence.rs	부모 디렉터리 권한 변경과 부모 디렉터리 교체를 검증합니다. 생성 파일이 다른 파일로 교체된 경우 대체 파일을 보존하고 오류를 반환하는지 검증합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🟡 Moderate · up to d0012

Private evidence creation can fail under some umask settings after leaving a zero-byte file, which can block retries at the same path. The file mode must be enforced and the failure path addressed before this change is merge-ready.

Sequence Diagram(s)

sequenceDiagram
  participant 저장 함수
  participant 부모 디렉터리
  participant openat
  participant 증거 파일
  저장 함수->>부모 디렉터리: 권한 및 device/inode 검증
  저장 함수->>openat: O_EXCL, O_NOFOLLOW, 0600으로 생성
  openat-->>증거 파일: 열린 파일 반환
  저장 함수->>증거 파일: 동기화 및 최종 객체 검증
  저장 함수->>부모 디렉터리: 디렉터리 동기화

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 private evidence 생성을 디렉터리 식별자에绑定하는 주요 보안 변경을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/private-evidence-object-bound-v1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@OpenCode review current head 5c44aa7. Current head already contains the post-create parent replacement regression and opened-file mode normalization; reassess only remaining source-backed issues.

[seonghobae]

@OpenCode review current head 33a9383. Re-evaluate the private-evidence race/tombstone findings against the latest branch; prior review was on older head.

[seonghobae]

@OpenCode review current head 1eb947e. Fixed the exact macOS build failure: openat variadic mode argument now uses C-compatible libc::c_uint; no other behavior changed.

[seonghobae]

@OpenCode review current head 1eb947e. Re-evaluate the exact macOS E0617 fix and current private-evidence authority tests; the stale review findings are already covered by set_permissions, helper-based parent revalidation, before_finalize replacement tests, and tombstone assertions.

[seonghobae]

Marked ready at exact head 1eb947e. Hosted checks are green except the required OpenCode review is pending; @OpenCode review current head and use only exact-head evidence.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[seonghobae]

@OpenCode review current head 1eb947ec9d4e591638230a8cb24af4d5b14ae35b. Re-evaluate only this exact head; all hosted checks are green. Publish approval only if the current evidence supports it.