Repository navigation
Library open path: lazy-protection race and read memory #450
Description
Split out of #444 design v3 (/tmp/444-design-v3.md §10), source at bfefe92. Found by Codex's cross-family review of design v2. This is an existing gap, not introduced by #444. Irzhy should judge whether it must move to 0.8.0.
- FU9: lazy protection runs outside the object lock (
library.rs:3647-3665,:3839-3859). Between the read and the write another writer can change the file. Home cannot start, update or show Recovery with a file over 16 MiB (or 64 MiB total) in Library folders #444 v3 only adds the class and size checks. - FU10: opening a large envelope holds about 4.7 times its size in memory (
auth.rs:5298-5320,:5273-5295). This is an estimate from the design.
Done means: lazy protection is atomic with respect to other writers, and open memory is bounded by a small multiple of a chunk, or measured and accepted.
Activity
andersalm commentedon Oct 19, 2026
Added from #444 review:
O_NOFOLLOWwithoutO_NONBLOCK(auth.rs:5418-5432), while it holds the global and lifecycle locks.auth.rs:5374-5377→:7973-7979), reached per Library listing item. Cap the read at the largest envelope ElastOS writes, about 134 MiB.auth.rs:5438-5486). It reads and classifies outside the lock.viewer_gateway.rs:319-345→:871-891), with the absolute host path and, for another key, the Home's key id. Give apps a fixed error code (the same for Librarydetail,library.rs:7151-7160).<data-dir>(Codex note).Source: #444 security review (
security-reviewer, reviewed453f56eb2and fix deltade2cf6276; local report/tmp/sec444.md) and Codex review/tmp/codex-runs/c444fix.final.md. Line refs atde2cf6276onfix/444-check-at-open.andersalm commentedon Oct 19, 2026
Codex’s completed review passes the correction at
3d5af5d077e611274e9e23bc56ba9d8e979f8a3d; it closes the prior rejection of authentic noncanonical envelopes. Full review SHA-256:8cbddc8c2ec1c37b58521cde26522cf0d5615312c9c19640828b3cf2b6ee7137.The exact source gate also passed in 1196 s, including both new regressions. Recognized foreign labels get an early refusal; unreadable labels retain the existing whole-file read cost.
This unpublished correction remains in QA / Review for OMP integration and installed acceptance. Source checks leave the complete #444 and #93 journeys open.
irzhywau commentedon Oct 21, 2026
Added from Irzhy's #444 review (existed before #444): offline migration checks a file's size, then reads it with no limit (
auth.rs:8320,:8901). A file swapped in between can use unlimited memory, and a link swapped in after the link check is followed. Both need software running as the same user. Fix: bound the read and open withO_NOFOLLOW, as the scan already does.irzhywau commentedon Oct 23, 2026
Low follow-ups from the #444 review of develop; none blocks 0.8.0. (1) Extract with Replace deletes a same-named folder or file without a damage check, so Blocked files in it are deleted too. Replace should stop at a folder or a damaged file.
(2) The archive builders follow folder links; they should skip links. (3) Kit export returns 409 "approve again" for every activation error, including disk errors that show a host path; only an approval error should give 409.
(4) Auth error responses and the Library Blocked label choose their result from error text. Typed errors would keep the result correct when the text or a folder name changes.
Generated by Claude Code