fix: normalize home path aliases before policy evaluation (closes a live policy-write bypass) - #121
Open
Arakiss wants to merge 1 commit into
Open
fix: normalize home path aliases before policy evaluation (closes a live policy-write bypass)#121Arakiss wants to merge 1 commit into
Arakiss wants to merge 1 commit into
Conversation
Bash redirects surface a write target as a literal tilde path (the shell
never expands ~ inside the string the mapper sees), while native tool writes
surface expanded absolute paths. Policy rules written with ${HOME} only
matched the expanded form, so a redirect like `cat >> ~/.gommage/policy.d/x`
fell through every ${HOME}-based rule — including the harness-integrity rules
that protect the policy, the agent hooks, and the gommage binaries.
Canonicalize ~, ~/, $HOME/ and ${HOME}/ for fs.read/fs.search/fs.write at
policy load and evaluation (lexical, deterministic; no realpath, no symlink
resolution, relative paths untouched). Remove the now-redundant duplicate
tilde forms from the stdlib filesystem policy. Regression fixtures reproduce
the exact production bypass and the whole ${HOME} class; they fail on the
prior code and pass here.
Found in production: an agent session widened its own permissions by editing
gommage policy via a tilde redirect that no protecting rule matched.
Implemented-by: Codex (gpt-5.5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bypass (found in production today)
An agent session widened its own permissions by editing gommage policy with
cat >> ~/.gommage/policy.d/...— the one action the policy is designed to prevent — without a picto and without hittingdeny-gommage-home-tamper.Root cause: Bash redirects surface the write target as a literal tilde path (the shell never expands
~inside the string the mapper sees), while native tool writes surface expanded absolute paths. Rules written with${HOME}only matched the expanded form, so any tilde-form redirect evaded every${HOME}-based rule — the policy, the agent hooks (~/.claude/settings.json,~/.claude/hooks/**), and the gommage binaries. Systemic, not a single rule.Fix: canonicalize
~,~/,$HOME/,${HOME}/for fs.read/search/write at policy load + evaluation (lexical, deterministic — no realpath, no symlink resolution, relatives untouched). Duplicate tilde forms removed from the stdlib filesystem policy.Verification (independent, by the reviewer)
cat >> ~/.gommage/policy.d/x→deny-gommage-home-tamper) plus the whole class (~/.claude/settings.json, hooks, binaries).None.cargo test --workspace,cargo fmt --all --check,cargo clippy --all-targets -D warningsgreen. (One preexisting unrelated failure:publish_crates_script_parses_crates_io_rate_limit_retry_afterfails on clean main too — env-dependent, out of scope.)Operator action required
The fix only takes effect once you rebuild and reinstall the gommage binary — installing the decision path is deliberately an operator action, not an agent one. Do not merge-and-forget: build, install, and verify
cat >> ~/.gommage/policy.d/probeis gated.Implemented by Codex (gpt-5.5) under an operator-approved brief; diagnosis and tests verified independently.