Credential home under a shared parent can be renamed aside before auth use

[batmnnn]

Summary

prepareCodexSecurityCredentialHome creates …/codex-home as mode 0700 and checks only the leaf owner/mode. It does not walk ancestors for sticky / trusted ownership, and later credential use paths (acquireCodexSecurityCredentialHomeLock, codexSecurityHasStoredFileCredentials, login/logout fallbacks) do not re-verify privacy or ancestry.

On a group/world-writable non-sticky parent, another local UID can mv the private credential home aside and read auth.json (ChatGPT / API session material). This is the same cross-user rename class as scan-output issue #109 / PRs #110+#118, but currently unfixed for durable auth state.

Default ~/.codex/... is usually fine. Any CODEX_SECURITY_STATE_DIR / custom state under a shared volume is exposed.

Evidence (current main @ 9c7634b, @openai/codex-security@0.1.4)

sdk/typescript/src/runtime.ts — prepare only enforces leaf privacy:

• prepareCodexSecurityCredentialHome → mkdir/chmod 0700 → requirePrivateCredentialHome(leaf)
• no sticky / trusted-ancestor walk
• acquireCodexSecurityCredentialHomeLock and codexSecurityHasStoredFileCredentials do not re-check the home before use
• auth.json existence checks require a regular non-symlink file but not private mode/owner

Open PR #118 hardens scan output ancestry only; it does not touch the credential-home path.

Steps to reproduce

mkdir -p /shared/cs && chmod 777 /shared/cs   # no sticky bit
export CODEX_SECURITY_STATE_DIR=/shared/cs/state
# victim: login / scan with stored credentials → …/state/codex-home/auth.json (0700)
# other UID:
mv /shared/cs/state/codex-home /shared/cs/stolen
# read /shared/cs/stolen/auth.json

Sticky parents (e.g. /tmp with the sticky bit) are safe; non-sticky shared parents are not rejected today.

Why in scope (SECURITY.md)

• Credentials must stay out of other security principals
• File-replacement races that expose credentials / private local state
• Same boundary already accepted for scan output in Scan output under a shared parent can be replaced before completion #109

Suggested fix

Reuse / mirror #118 helpers (requireSecureOutputAncestry / requireTrustedOutputAncestor):

1. Reject non-sticky shared ancestors and untrusted parent owners for the credential home
2. Re-check on prepare and every use path (lock, stored-auth probe, login/logout)
3. Enforce private mode/owner on auth.json before treating stored credentials as present
4. Pin (st_dev, st_ino) for the duration of a credential-home lock session (durable cross-process pin optional/deferred without a workbench row)

Affected version

• @openai/codex-security@0.1.4
• Confirmed on main at 9c7634b