Repository navigation
Create the prepared grader snapshot directory as owner-only - #1941
Merged
Merged
Conversation
The prepared repository for mechanical checks lives in a shared temporary directory. Create that directory with mode 0700 so other accounts cannot read it.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
let directory = tempfile::Builder::new() .prefix("prepared-grader-") + .permissions(fs::Permissions::from_mode(0o700)) .tempdir()?;A Trial with checks copies the prepared repository into
prepared-grader-*in the shared temporary directory before the session starts. That directory is now created owner-only, the same way the code Grader packet is.Seam: the snapshot directory's mode, observed from the Trial completion callback while the directory still exists.
Evidence
Execution evidence
Before:
cargo test --bin thirdshift evals::experiment::execution::tests::the_prepared_grader_snapshot_directory_is_private_to_its_owner -- --exact509 is mode 0775; 448 is mode 0700.
After: the same command:
cargo test --bin thirdshift evals::experiment::execution::teststhen passed all 22 tests.scripts/affected-tests mainran the full Rust suite:PASS cargo nextest run (2538.44s).No visual change.
Unaddressed findings
Standards: none.
Spec: none.
Security: none.
Changed files the review left unread: none.
Security review outcome
No unaddressed introduced findings.
Merge Danger
Door: two-way
Reverting the commit restores the previous directory mode. Trials already running keep the directory they created.
Blast Radius: Trials
Every Trial with mechanical checks creates this directory. Other accounts on the machine can no longer read the prepared repository there. Checks still grade that copy.
Closes #1939
Built with grok grok 1.0.70 (f50904eaee6c) [stable] · default model · default effort