Repository navigation
Preserve SQLite locks during session permission checks - #478
Open
Broccolito wants to merge 1 commit into
Open
Broccolito wants to merge 1 commit into
Broccolito wants to merge 1 commit into
Conversation
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Permission checks can release a running SQLite connection’s POSIX locks by opening and closing another handle to the same database or sidecar inode. A separate read/write SQLite client can then unlink a live WAL, leaving subsequent session changes unavailable through a new reader or after restart.
Use descriptor-free nofollow permission and ACL operations on macOS, and pinned
O_PATHdescriptors with procfs metadata operations on Linux. Existing ownership, regular-file, hard-link, symlink, mode and ACL checks remain enforced. Linux fails closed when its procfs descriptor path is unavailable.The regression keeps a pool live while validating storage, opening a second manager, and closing an independent SQLite reader; it checks WAL identity and later writes after reopening. Existing ACL and outside-file protection tests remain covered.
Validation: all 10
session_storage_securitytests pass, including the new cross-process WAL regression and existing ACL/alias protections.just check-everythingpasses, including strict and baseline clippy, frontend lint, generated OpenAPI, socket inheritance, naming, version and registry guards. A separate controlled reproduction confirms that the regression reader removes a live WAL under the legacy ordinary-handle-close pattern and preserves it without that pattern.Fresh CLI/daemon live testing kept API and external read/write SQLite readers in agreement before and after later writes. The full gate plan, monitor settings and decision records survived a daemon restart and restored correctly in Electron. Two independent source reviews found no actionable issues.