Follow-up from #30 / #39. Filing only — not fixed there.
What
buildRelayfileMountInitialSyncBackgroundShell now creates the generated launcher script under (umask 077 && cat > ...) and verifies the landed mode is 600 before handing it to a detached process. The log it redirects the sync into (RELAYFILE_INITIAL_SYNC_LOG_PATH, suffixed per run id) is still created by a plain shell redirection, so it lands at whatever the process umask gives — 0644 under the sandbox's 022.
Exposure class
A world-readable diagnostic file in a shared temp directory that captures the daemon's own stdout and stderr. The log is treated as "non-secret failure diagnostics", but that is an assumption about what the daemon prints, not a property the launcher enforces: usage errors, verbose modes and argv echoes are the ordinary ways a credential or a scoped workspace path reaches a diagnostic stream. The file also outlives the sync deliberately, so anything that does land in it persists.
This is the same class as #30 — a launcher-created file inheriting the umask instead of being constrained at creation — applied to the one path #30 left alone.
Suggested fix
Constrain the log at creation the way the script now is, rather than chmod-ing after the fact: create it under umask 077 before the redirection, or open the redirection inside a (umask 077 && ...) subshell, and keep the same post-write mode verification. The pid and exit sentinels carry no daemon output and can stay as they are.
A test should execute the launcher under an explicit umask 022 and stat the log that actually lands, not assert on the generated shell — see the gating test added in #39.
Follow-up from #30 / #39. Filing only — not fixed there.
What
buildRelayfileMountInitialSyncBackgroundShellnow creates the generated launcher script under(umask 077 && cat > ...)and verifies the landed mode is600before handing it to a detached process. The log it redirects the sync into (RELAYFILE_INITIAL_SYNC_LOG_PATH, suffixed per run id) is still created by a plain shell redirection, so it lands at whatever the process umask gives —0644under the sandbox's022.Exposure class
A world-readable diagnostic file in a shared temp directory that captures the daemon's own stdout and stderr. The log is treated as "non-secret failure diagnostics", but that is an assumption about what the daemon prints, not a property the launcher enforces: usage errors, verbose modes and argv echoes are the ordinary ways a credential or a scoped workspace path reaches a diagnostic stream. The file also outlives the sync deliberately, so anything that does land in it persists.
This is the same class as #30 — a launcher-created file inheriting the umask instead of being constrained at creation — applied to the one path #30 left alone.
Suggested fix
Constrain the log at creation the way the script now is, rather than chmod-ing after the fact: create it under
umask 077before the redirection, or open the redirection inside a(umask 077 && ...)subshell, and keep the same post-write mode verification. The pid and exit sentinels carry no daemon output and can stay as they are.A test should execute the launcher under an explicit
umask 022andstatthe log that actually lands, not assert on the generated shell — see the gating test added in #39.