From d275f1ec233823d9c3139c1c266a9577122cb7eb Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 24 Jun 2026 07:01:15 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?=
 =?UTF-8?q?x=20unsafe=20permission=20handling?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: acebytes <2820910+acebytes@users.noreply.github.com>
---
 .jules/sentinel.md                           | 4 ++++
 Sources/Cacheout/Headless/DaemonMode.swift   | 5 ++++-
 Sources/Cacheout/Headless/StatusSocket.swift | 6 +++++-
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 343036e..9c02a5a 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -143,3 +143,7 @@ grep -nE "O_NOFOLLOW|O_CLOEXEC|fchmod|withUnsafeFileSystemRepresentation" <candi
 **Vulnerability:** Calling `open(2)` with raw Swift `String` paths in `StatusSocket.swift` creates an unsafe filesystem representation.
 **Learning:** Passing Swift `String` paths implicitly to C functions can result in memory issues or incorrect path resolution if the string is not null-terminated or is moved in memory.
 **Prevention:** Always use `URL(fileURLWithPath:).withUnsafeFileSystemRepresentation` to obtain the correct C-string pointer when bridging file paths to POSIX APIs.
+## 2026-05-04 - Fix fail-open POSIX permission handling
+**Vulnerability:** Ignored return values from POSIX C APIs (`fchmod`, `fchmodat`) caused fail-open behavior.
+**Learning:** While high-level Swift APIs inherently fail-closed by throwing errors, dropping down to C APIs to avoid TOCTOU introduces the risk of silently ignoring failures.
+**Prevention:** Always explicitly check the integer return codes of POSIX C APIs and securely fail-closed on error.
diff --git a/Sources/Cacheout/Headless/DaemonMode.swift b/Sources/Cacheout/Headless/DaemonMode.swift
index 8bd4a55..bc19d8b 100644
--- a/Sources/Cacheout/Headless/DaemonMode.swift
+++ b/Sources/Cacheout/Headless/DaemonMode.swift
@@ -981,7 +981,10 @@ public actor DaemonMode: StatusSocket.DataSource {
             guard let pathPtr = pathPtr else { return nil }
             let fd = open(pathPtr, O_RDONLY | O_NOFOLLOW | O_CLOEXEC)
             guard fd >= 0 else { return nil }
-            fchmod(fd, 0o600)
+            guard fchmod(fd, 0o600) == 0 else {
+                close(fd)
+                return nil
+            }
             let handle = FileHandle(fileDescriptor: fd, closeOnDealloc: true)
             return try? handle.readToEnd()
         }
diff --git a/Sources/Cacheout/Headless/StatusSocket.swift b/Sources/Cacheout/Headless/StatusSocket.swift
index 8cd6661..aa5884b 100644
--- a/Sources/Cacheout/Headless/StatusSocket.swift
+++ b/Sources/Cacheout/Headless/StatusSocket.swift
@@ -184,7 +184,11 @@ public final class StatusSocket: @unchecked Sendable {
         }
         if (sockStat.st_mode & 0o777) != 0o600 {
             // umask should have set 0600; defense-in-depth chmod via no-follow.
-            _ = fchmodat(AT_FDCWD, socketPath, 0o600, AT_SYMLINK_NOFOLLOW)
+            guard fchmodat(AT_FDCWD, socketPath, 0o600, AT_SYMLINK_NOFOLLOW) == 0 else {
+                close(fd)
+                unlink(socketPath)
+                throw StatusSocketError.bindFailed(errno)
+            }
         }
 
         // Listen