3c25f097fa
The first hardening pass created the update-phase.json temp with mktemp INSIDE ./run (the container-writable bind mount) and reopened it by pathname (`> "$tmp"`). A container racing the root writer could unlink that temp and drop a symlink in its place before the reopen, redirecting the root write outside ./run. All THREE status-writers now build the temp at the repo ROOT — same filesystem as ./run (so the follow-up mv -f is an atomic, symlink-safe rename(2)) but NOT mounted into any container, so it cannot be tampered mid-write: watch.sh run_write_json, update.sh set_stage, AND install.sh set_stage (reachable as root directly and via update.sh -> exec install.sh). The transient /.phase.* temps are gitignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| caddy | ||
| clusev | ||
| motd | ||
| nginx | ||
| php | ||
| release | ||
| restart-sentinel | ||
| supervisor | ||
| terminal | ||
| wg | ||
| entrypoint.sh | ||