From e29b027c4772a430d437a0e2dff1c2b6ff7458c1 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 3 Jul 2026 07:39:23 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?=
 =?UTF-8?q?x=20unsafe=20path=20handling?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enforced fail-closed behavior for file attribute changes in StatusSocket.swift to prevent fail-open scenarios when fchmodat fails.

Co-authored-by: acebytes <2820910+acebytes@users.noreply.github.com>
---
 .jules/sentinel.md                           | 4 ++++
 Sources/Cacheout/Headless/StatusSocket.swift | 6 +++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index 343036e..bfe6b00 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -143,3 +143,7 @@ grep -nE "O_NOFOLLOW|O_CLOEXEC|fchmod|withUnsafeFileSystemRepresentation" <candi
 **Vulnerability:** Calling `open(2)` with raw Swift `String` paths in `StatusSocket.swift` creates an unsafe filesystem representation.
 **Learning:** Passing Swift `String` paths implicitly to C functions can result in memory issues or incorrect path resolution if the string is not null-terminated or is moved in memory.
 **Prevention:** Always use `URL(fileURLWithPath:).withUnsafeFileSystemRepresentation` to obtain the correct C-string pointer when bridging file paths to POSIX APIs.
+## 2026-05-04 - Fail-Open Security Vulnerability via Ignored fchmodat Error
+**Vulnerability:** Ignored the return value of `fchmodat(AT_FDCWD, socketPath, 0o600, AT_SYMLINK_NOFOLLOW)` by using `_ =`.
+**Learning:** `fchmodat` on Apple platforms returns `ENOTSUP` (errno 95) if the target is a symlink when the `AT_SYMLINK_NOFOLLOW` flag is used. While this inherently prevents a TOCTOU symlink traversal, the permission change fails completely. Ignoring the error results in a fail-open scenario where the target might maintain insecure permissions (e.g. 0o777).
+**Prevention:** Always verify the return value of POSIX C API calls like `fchmodat` and explicitly fail-closed (e.g., throw an error) if the operation fails, rather than silently ignoring the error and proceeding with potentially insecure state.
diff --git a/Sources/Cacheout/Headless/StatusSocket.swift b/Sources/Cacheout/Headless/StatusSocket.swift
index 8cd6661..aa5884b 100644
--- a/Sources/Cacheout/Headless/StatusSocket.swift
+++ b/Sources/Cacheout/Headless/StatusSocket.swift
@@ -184,7 +184,11 @@ public final class StatusSocket: @unchecked Sendable {
         }
         if (sockStat.st_mode & 0o777) != 0o600 {
             // umask should have set 0600; defense-in-depth chmod via no-follow.
-            _ = fchmodat(AT_FDCWD, socketPath, 0o600, AT_SYMLINK_NOFOLLOW)
+            guard fchmodat(AT_FDCWD, socketPath, 0o600, AT_SYMLINK_NOFOLLOW) == 0 else {
+                close(fd)
+                unlink(socketPath)
+                throw StatusSocketError.bindFailed(errno)
+            }
         }
 
         // Listen