[ymote]

ADR 0004 gap review, G6 (medium). Follows #155 (G4).

The Terminal's macOS profile emitted home:rw after everything else, and nothing closed the OctoSense home again. A process app with a broad grant could read:

• peer host tokens (app-peers/*.token);
• every app's jail and secrets/<id>/ files;
• the kernel's data.

What changed

• Policy::private. The host's private directories:

  • the OctoSense home;
  • the apps and secrets roots (they may live elsewhere);
  • the kernel's core dir, and the kernel home around a .octos core dir.

  clients::sandbox_policy sets it for every process app.

• macOS. After every grant, a final (deny file-read* file-write* ...) on those directories. Then only the app's own jail and secrets are opened again, with the metadata of their ancestors.

• Linux (Landlock). Landlock cannot deny beneath an allowed directory, so a grant that contains a private directory is split. Each entry is granted on its own, recursing only toward the private directories, which get nothing. A link into one gets nothing either. The own jail and secrets are granted by themselves.

  • Documented limits: entries created later directly in a split directory (a new file in ~) are not covered, and the directories on the way cannot be listed.
  • Not run here: the dev machine is macOS, and a Linux cross-check needs a C cross toolchain it lacks. The Landlock split has a unit test that runs on Linux only.

Tests

• home_rw_never_reaches_the_octosense_home_or_the_kernel, a real sandboxed child (as in ADR 0004: the peer link for process apps, process sandboxes, Restart tile for dead process apps [skip ci] #130). The child has home:rw over a scratch home that also holds the OctoSense home and the kernel home.
  • It reads the person's files and its own jail and secrets.
  • It is refused the peer token, another app's jail and secrets, the shell's settings, the kernel's core dir and kernel home, and writing into the OctoSense home. It cannot list other apps' jails.
• the_macos_profile_closes_the_octosense_home_after_every_grant: rule order.
• the_private_dirs_are_the_homes_roots_and_the_kernels
• landlock_splits_a_grant_around_the_private_dirs (Linux only)

Local checks

These all passed:

• cargo check for desktop (default and mobile-apps) and for phone (octosense-home --features mobile-apps)
• cargo test -p octosense-shell --lib on desktop and on phone
• app-peers (octos-core,ws) and ai-host (octos-core,llm) tests
• tools/check-shell-graph.sh for both shells
• tools/setup.py --check --cargo
• tools/native_apps.py --check

🤖 Generated with Claude Code