fix(platform): 支持 BOTMUX_SKIP_HOST_AUTH_CHECK 跳过宿主凭证祖先链检查#565
Open
gavxin wants to merge 1 commit into
Open
Conversation
共享 devbox（如 BOE）上 ~/.botmux 的某级祖先目录（如 /data00）常归属 无关服务账号且 owner 可写（0755），会触发 secure-host-file 的祖先链 可替换检查 UnsafeHostAuthorityFileError，导致 botmux bind / 读绑定 / device.json 全部报错，且用户无权 chmod 该级目录、删除重建 .botmux 也无效。 改动： - assertAncestorChainCannotReplace 支持 BOTMUX_SKIP_HOST_AUTH_CHECK=1， 设置后仅跳过「祖先链可替换」这一条遍历，每进程打一次 stderr 警告； .botmux 本身的直接校验（owner 属主、严格 0600、无组/其他写、拒绝 符号链接）全部保留，不降级凭证文件安全性。 - 抛错信息补充具体罪魁祖先路径 + 逃生阀提示，该提示挂在 error.message 上，自动传播到三个出口：读绑定 [platform-binding] 拒绝读取、botmux bind 写崩溃栈、device.json 相关错误（binding.ts / device.ts 均透传 message）。 影响面：改的是 binding + device 两条凭证路径共用的底层原语，但默认 （不设环境变量）行为与原来完全一致，仅新增显式 opt-out 分支；Windows 分支在函数首行即 return，不受影响。 验证：pnpm build 通过；vitest run test/secure-host-file.test.ts 6 passed （含新增用例：验证逃生阀开启后可写读，同时确认组/其他可写目录仍 fail-closed）。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
共享 devbox（如 BOE）上 ~/.botmux 的某级祖先目录常归属无关服务账号且 owner 可写（0755），会触发 secure-host-file 的祖先链可替换检查 UnsafeHostAuthorityFileError，导致 botmux bind / 读绑定 / device.json 全部报错，且用户无权 chmod 该级目录、删除重建 .botmux 也无效。
改动：
影响面：改的是 binding + device 两条凭证路径共用的底层原语，但默认（不设环境变量）行为与原来完全一致，仅新增显式 opt-out 分支；Windows 分支在函数首行即 return，不受影响。
验证：pnpm build 通过；vitest run test/secure-host-file.test.ts 6 passed （含新增用例：验证逃生阀开启后可写读，同时确认组/其他可写目录仍 fail-closed）。