From 21e72726f09a36954d63e6db8b9b329be3b95088 Mon Sep 17 00:00:00 2001 From: Rongsong Shen Date: Sat, 26 Sep 2026 09:25:46 +0000 Subject: [PATCH] chore: sync bug-1508/1868/1869 to Gitea (#287-#289), refresh STATUS.md Co-Authored-By: Claude Opus 5.5 (1M context) --- .wolf/STATUS.md | 13 +++++++++---- .wolf/buglog.json | 6 ++++++ 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/.wolf/STATUS.md b/.wolf/STATUS.md index 3e24b443..281ac183 100644 --- a/.wolf/STATUS.md +++ b/.wolf/STATUS.md @@ -7,17 +7,22 @@ ## βœ… Done +- **Worker security fixes** (2026-09-26, pushed, all TDD REDβ†’GREEN, worker suite 12/12, sequential HA soaks PASS on xcecd_virtual): + - **bug-1508** (`7723a4f4`): worker `fetchfile` (root) opened any path. Now only `/job__task.out` for the request's jobid (exact match, `xcecd_is_job_output_path()` in `worker/include/job_output_path.h`), O_NOFOLLOW|O_NONBLOCK, regular single-link file. Also closed the REST route (submit with `out_file=/etc/shadow`, then GET output). + - **bug-1868** (`7864a3da`): job output file created as root in /tmp followed planted links. `xcecd_create_job_output()` unlinks + O_EXCL|O_NOFOLLOW. + - **bug-1869** (`5df33e69`): `xcecd_worker.log` (was chmod 0666 by path), `/tmp/xcecd_worker.log` append, and the restart flag. `worker/include/xcecd_tmpfile.h`: `xcecd_open_owned_file()` / `xcecd_owned_file_exists()`, fchmod instead of chmod(path). + - Live gap: the sandbox only runs `xcecd_virtual`, so the real root worker's output/log creation is covered by unit tests only. - **bug-1754** (2026-09-26, `6876e4f6`, pushed): a failed job's exit code is now persisted. A worker reports every nonzero exit as a FAIL (not FINISH), and WAL_JOB_FAIL had no code slot, so `job.exit_info` was NULL for every failed job. WAL_JOB_FAIL now carries an int32 code trailer (`persist_submit_job_fail_fact`); both apply seams adopt it via `apply_job_fail_exit_code()` (non-POST_EXEC stages only). `apply_wal_entry` also no longer assigns wire state 0 for STAGE_FLAG FAIL entries. New `test_wal_job_fail_fact.c`; controller suite 1228/0. Soaks: sequential 6 rounds PASS (SIMVERIFY 7 files, 0 mismatches) + factstream 2 rounds PASS. - **HA stability fixes** (2026-09-25, pushed, soak-verified): bug-1864 (per-endpoint FIFO in vtask dispatcher), bug-1865 (primary control endpoint refcounted, no double-close), bug-1850 (NOT_READY retries in place, no failover rotate), bug-1854 (re-pushed resource defs are idempotent). - **bug-1714 / bug-1840** marked cannot-reproduce (0 crashes across 2,400-element burst on old + current builds). -- **Gitea sync** (2026-09-26): issues #264-#286 created (recent bugs + bug-1798..1804, 1714, 1754, 1850, 1854), #74 closed. Only a subset of the buglog is mirrored by design; `scripts/gitea-sync.py` gained `--ids` because bulk triage bumped the date fields `--since` relies on. +- **Gitea sync** (2026-09-26): issues #264-#289 created (#287-#289 = bug-1508/1868/1869) (recent bugs + bug-1798..1804, 1714, 1754, 1850, 1854, 1508, 1868, 1869), #74 closed. Only a subset of the buglog is mirrored by design; `scripts/gitea-sync.py` gained `--ids` because bulk triage bumped the date fields `--since` relies on. - Logged: **bug-1866** (worker `launch_type` leak), **bug-1867** (controller snapshot drops `exit_info` β€” capnp `Job` has no exit field). --- ## πŸš€ Next phase -**Goal:** _None active._ Suggested order: bug-1508 (fetchfile path check, security) β†’ bug-1747 FAIL half (add finish_time to the new WAL_JOB_FAIL trailer) β†’ bug-1867 β†’ `xce_test` harness batch + bug-1866 β†’ a tasks-ready spec. +**Goal:** _None active._ Suggested order: bug-1747 FAIL half (add finish_time to the WAL_JOB_FAIL trailer) β†’ bug-1867 (snapshot exit_info, capnp schema) β†’ `xce_test` harness batch + bug-1866 β†’ a tasks-ready spec. ### Open items (not yet actioned) - _none pending_ @@ -26,14 +31,14 @@ - _none pending_ ### Open decisions -- _none pending_ +- **REST job output for jobs with a custom `out_file`/`err_file`**: the worker never writes those paths (always `/tmp/job__task.out`), so since bug-1508 `GET /jobs/:id/output` for such a job returns a permission error from the worker. Either the apiserver's `resolveOutputPath()` (controllers/output.go) always targets the worker's own output file, or the worker starts honouring `out_file`. Waiting on the user. --- ## πŸ“ Active architecture - **Stack:** Go API/CLI tier (`src/frontend/apiserver`) fronting C daemons (`src/controller`, `src/worker`, `src/scheduler`); Meson-based build via `src/tools/xce-build.sh`, hermetic nix dev shell. -- **Current focus area:** `src/controller` persistence β€” WAL fact payloads and apply seams (`persist.c` `apply_committed_entry` / `apply_wal_entry`, `job.c` `record_job_*_fact`). +- **Current focus area:** `src/controller` persistence (WAL fact payloads/apply seams in `persist.c`, `job.c`) and worker root-privilege file handling (`src/worker/include/job_output_path.h`, `xcecd_tmpfile.h`). --- diff --git a/.wolf/buglog.json b/.wolf/buglog.json index c6510014..3c335b42 100644 --- a/.wolf/buglog.json +++ b/.wolf/buglog.json @@ -18082,6 +18082,8 @@ }, { "id": "bug-1508", + "gitea_synced_status": "fixed", + "gitea_issue": 287, "status": "fixed", "status_updated": "2026-09-26", "status_note": "7723a4f4: worker fetchfile accepts only /job__task.out for the request's jobid (exact match), O_NOFOLLOW|O_NONBLOCK, regular single-link file. Also closed the REST route (user out_file=/etc/shadow).", @@ -28111,6 +28113,8 @@ }, { "id": "bug-1868", + "gitea_synced_status": "fixed", + "gitea_issue": 288, "status": "fixed", "status_updated": "2026-09-26", "status_note": "7864a3da: xcecd_create_job_output() unlinks then creates with O_EXCL|O_NOFOLLOW|O_CLOEXEC.", @@ -28134,6 +28138,8 @@ }, { "id": "bug-1869", + "gitea_synced_status": "fixed", + "gitea_issue": 289, "status": "fixed", "status_updated": "2026-09-26", "status_note": "5df33e69: xcecd_open_owned_file()/xcecd_owned_file_exists() (xcecd_tmpfile.h) for the worker log, xcecd_worker.log and restart flag; fchmod instead of chmod(path).",