fix(bootstrap): harden development sandbox root

commit: 114ac55b695c41d6d43b2e1cc5d34c2c4dbaac80
author: brice · 2mo ago · 2026-08-15 13:09 UTC
parent: 7e592a5
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +17 -1

M internal/bootstrap/development_environment.go +1 -1


@@ -25,7 +25,7 @@ func ApplyDevelopmentEnvironment() error {
25	25		}
26	26
27	27		devDir := filepath.Join(cwd, ".dev")
28		-	if err := ensureDevelopmentDirectory(devDir, false); err != nil {
	28	+	if err := ensureDevelopmentDirectory(devDir, true); err != nil {
29	29		return err
30	30		}
31	31


@@ -25,7 +25,7 @@ func ApplyDevelopmentEnvironment() error {
25		}	25		}
26			26
27		devDir := filepath.Join(cwd, ".dev")	27		devDir := filepath.Join(cwd, ".dev")
28	-	if err := ensureDevelopmentDirectory(devDir, false); err != nil {	28	+	if err := ensureDevelopmentDirectory(devDir, true); err != nil {
29		return err	29		return err
30		}	30		}
31			31

M internal/bootstrap/development_environment_test.go +16 -0


@@ -39,6 +39,22 @@ func TestApplyDevelopmentEnvironment_DevIsolatesHomeAndXDGDirectories(t *testing
39	39		require.Equal(t, "/run/user/1000", os.Getenv("XDG_RUNTIME_DIR"))
40	40		}
41	41
	42	+	func TestApplyDevelopmentEnvironment_DevTightensExistingDevDirectoryPermissions(t *testing.T) {
	43	+	worktree := t.TempDir()
	44	+	t.Chdir(worktree)
	45	+	t.Setenv("ENV", developmentEnvironmentName)
	46	+
	47	+	devDir := filepath.Join(worktree, ".dev")
	48	+	require.NoError(t, os.Mkdir(devDir, 0o777))
	49	+	require.NoError(t, os.Chmod(devDir, 0o777))
	50	+
	51	+	require.NoError(t, ApplyDevelopmentEnvironment())
	52	+
	53	+	info, err := os.Stat(devDir)
	54	+	require.NoError(t, err)
	55	+	require.Equal(t, os.FileMode(0o700), info.Mode().Perm())
	56	+	}
	57	+
42	58		func TestApplyDevelopmentEnvironment_DevRejectsSandboxSymlink(t *testing.T) {
43	59		worktree := t.TempDir()
44	60		t.Chdir(worktree)


@@ -39,6 +39,22 @@ func TestApplyDevelopmentEnvironment_DevIsolatesHomeAndXDGDirectories(t *testing
39	require.Equal(t, "/run/user/1000", os.Getenv("XDG_RUNTIME_DIR"))	39		require.Equal(t, "/run/user/1000", os.Getenv("XDG_RUNTIME_DIR"))
40	}	40		}
41		41
		42	+	func TestApplyDevelopmentEnvironment_DevTightensExistingDevDirectoryPermissions(t *testing.T) {
		43	+	worktree := t.TempDir()
		44	+	t.Chdir(worktree)
		45	+	t.Setenv("ENV", developmentEnvironmentName)
		46	+
		47	+	devDir := filepath.Join(worktree, ".dev")
		48	+	require.NoError(t, os.Mkdir(devDir, 0o777))
		49	+	require.NoError(t, os.Chmod(devDir, 0o777))
		50	+
		51	+	require.NoError(t, ApplyDevelopmentEnvironment())
		52	+
		53	+	info, err := os.Stat(devDir)
		54	+	require.NoError(t, err)
		55	+	require.Equal(t, os.FileMode(0o700), info.Mode().Perm())
		56	+	}
		57	+
42	func TestApplyDevelopmentEnvironment_DevRejectsSandboxSymlink(t *testing.T) {	58		func TestApplyDevelopmentEnvironment_DevRejectsSandboxSymlink(t *testing.T) {
43	worktree := t.TempDir()	59		worktree := t.TempDir()
44	t.Chdir(worktree)	60		t.Chdir(worktree)