trending/codebase-memory-mcp
1
0
Fork 0
mirror of https://github.com/DeusData/codebase-memory-mcp.git synced 2026-11-11 09:25:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(cli): handle trusted Linux system aliases during install activation

Browse Source 
Signed-off-by: DavidHLP <144919470+DavidHLP@users.noreply.github.com>
This commit is contained in:
DavidHLP
2026-09-14 00:52:09 +08:00
parent 0b51555402
commit 00411ce7bc
1 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cli/activation_transaction.c
+13 -4
View File
@@ -890,8 +890,12 @@ static bool activation_posix_acl_empty(int descriptor) {
}
static char *activation_posix_walk_path(const char *directory) {
#ifdef __APPLE__
static const char *const aliases[] = {"/tmp", "/var"};
#if defined(__APPLE__) || defined(__linux__)
/* macOS and immutable Linux layouts can expose writable trees through
* root-owned aliases (for example /tmp and /home on Atomic systems).
* Resolve only these trusted system aliases; arbitrary user symlinks must
* still fail the O_NOFOLLOW walk below. */
static const char *const aliases[] = {"/tmp", "/var", "/home"};
for (size_t index = 0; index < sizeof(aliases) / sizeof(aliases[0]); index++) {
const char *alias = aliases[index];
size_t alias_length = strlen(alias);
@@ -901,8 +905,13 @@ static char *activation_posix_walk_path(const char *directory) {
}
struct stat alias_status;
char resolved[4096];
if (lstat(alias, &alias_status) != 0 || !S_ISLNK(alias_status.st_mode) ||
alias_status.st_uid != 0 || !realpath(alias, resolved)) {
if (lstat(alias, &alias_status) != 0) {
return NULL;
}
if (!S_ISLNK(alias_status.st_mode)) {
continue;
}
if (alias_status.st_uid != 0 || !realpath(alias, resolved)) {
return NULL;
}
struct stat resolved_status;