From 88243dcdbb90930f9df6fa991d6ae04c4ca09cb7 Mon Sep 17 00:00:00 2001 From: dan-claude-bot Date: Sat, 18 Jul 2026 16:01:57 +0000 Subject: [PATCH] =?UTF-8?q?fix(revoke):=20purge=20re-checks=20the=20incus-?= =?UTF-8?q?user=20state=20dir=20=E2=80=94=20as=20root,=20not=20as=20a=20ho?= =?UTF-8?q?peful=20stat?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit /var/lib/incus/users/ was removed for releases without being re-checked, and a bare [ -d ] from a non-root admin answers 'absent' for a directory that is very much there. Both the removal guard and the absence assert now test through $SUDO, closing the one residue the purge promised gone but never proved. Co-Authored-By: Claude Fable 5 --- host/revoke-user.sh | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/host/revoke-user.sh b/host/revoke-user.sh index 50f2574..5a86203 100644 --- a/host/revoke-user.sh +++ b/host/revoke-user.sh @@ -135,19 +135,26 @@ done < <(incus config trust list --format csv --columns nf 2>/dev/null) # incus-user's per-user client state (their key pair). Removed so a future # re-grant starts clean instead of trusting a key the purge revoked. -if [ -d "/var/lib/incus/users/$uid" ]; then +# $SUDO test, not a bare [ -d ]: /var/lib/incus is not traversable by a +# non-root admin, so an unprivileged stat answers "absent" for a directory +# that is very much there — the same lie the absence assert below must dodge. +if $SUDO test -d "/var/lib/incus/users/$uid" 2>/dev/null; then $SUDO rm -rf "/var/lib/incus/users/$uid" echo "purge: incus-user state for uid $uid removed" fi # Assert absence rather than trusting exit codes — the wipe.sh discipline. # The certificate included: its removal above is set -e-exempt (left of &&), -# and a promise the header makes is a promise this block checks. +# and a promise the header makes is a promise this block checks. The +# incus-user state directory too — it was purged for releases without being +# re-checked, which is exactly the gap this block exists to close. leftover="" incus project show "$project" >/dev/null 2>&1 /dev/null 2>&1 /dev/null | grep -q "^incus-user-$uid," \ && leftover="$leftover cert:incus-user-$uid" +$SUDO test -d "/var/lib/incus/users/$uid" 2>/dev/null \ + && leftover="$leftover /var/lib/incus/users/$uid" if [ -n "$leftover" ]; then echo "box revoke: purge INCOMPLETE — still present:$leftover" >&2 exit 1