The racing-reader sweep pins '| grep' only, and the same shape exists outside ufw (revoke-user.sh:206) #124

New issue

Closed

opened 2026-07-19 23:58:31 +00:00 by dan-claude-bot · 0 comments

dan-claude-bot commented

2026-07-19 23:58:31 +00:00

(Migrated from github.com)

Non-blocking observations from claude-bot-andresmgsl's review of #120, filed so they do not rot in a PR thread.

1. The sweep's own gap

#120 added a class sweep over host/*.sh drill/*.sh for the #102 racing-reader shape. Its matcher is:

ufw status[^|]*\| *grep

That catches ufw status | grep -m1 … — every historical instance — but not the same hazard spelled with a different early-exit reader:

ufw status | head -n1
ufw status | sed -n '1p;q'
ufw status | awk '/x/ {print; exit}'

All three close the pipe early, all three send SIGPIPE to ufw, and under pipefail all three produce the same wrong answer #102 was about. The sweep guards the instance spelling, not the class — which is the thing #120 was otherwise careful to get right.

A broader reader alternation (grep|head|sed|awk|read) would close it.

2. The nearest analog outside ufw

host/revoke-user.sh:206, under set -euo pipefail:

incus config trust list --format csv | grep -q "^incus-user-$uid,"

Same shape — a multi-line writer feeding a possibly-early-matching reader, used as a leftover-detection condition. If it ever took a 141, it would read as "no leftover cert" on a host that has one, i.e. fail open on a security-adjacent cleanup path.

Realistically un-racy today: the writer is small and likely completes in a single write, unlike ufw's flushed table. That is why #120 correctly declined to claim it — its sweep is scoped to ufw. But if the class discipline is meant to extend past ufw, this is where it goes next.

Explicitly not in this category: the id -nG | tr | grep -qx shapes in grant/revoke/setup — tiny single writes, not realistically racy.

Suggested scope

Two independent changes, either orderable:

Widen #120's reader alternation in test/cli.sh — cheap, closes the pin's gap.
Decide whether the sweep should cover non-ufw writers at all, and if so extend it to incus config trust list and audit similar conditions. This is the larger call, since it changes what the sweep claims to guarantee.

Refs

#120 (where these were raised), #102 (the original SIGPIPE defect), #107 (the drill/wipe.sh instance)

Non-blocking observations from `claude-bot-andresmgsl`'s review of #120, filed so they do not rot in a PR thread. ## 1. The sweep's own gap #120 added a class sweep over `host/*.sh drill/*.sh` for the #102 racing-reader shape. Its matcher is: ``` ufw status[^|]*\| *grep ``` That catches `ufw status | grep -m1 …` — every historical instance — but **not** the same hazard spelled with a different early-exit reader: - `ufw status | head -n1` - `ufw status | sed -n '1p;q'` - `ufw status | awk '/x/ {print; exit}'` All three close the pipe early, all three send SIGPIPE to `ufw`, and under `pipefail` all three produce the same wrong answer #102 was about. The sweep guards the *instance spelling*, not the *class* — which is the thing #120 was otherwise careful to get right. A broader reader alternation (`grep|head|sed|awk|read`) would close it. ## 2. The nearest analog outside ufw `host/revoke-user.sh:206`, under `set -euo pipefail`: ```bash incus config trust list --format csv | grep -q "^incus-user-$uid," ``` Same shape — a multi-line writer feeding a possibly-early-matching reader, used as a **leftover-detection condition**. If it ever took a 141, it would read as "no leftover cert" on a host that has one, i.e. fail *open* on a security-adjacent cleanup path. Realistically un-racy today: the writer is small and likely completes in a single write, unlike ufw's flushed table. That is why #120 correctly declined to claim it — its sweep is scoped to ufw. But if the class discipline is meant to extend past ufw, this is where it goes next. Explicitly **not** in this category: the `id -nG | tr | grep -qx` shapes in grant/revoke/setup — tiny single writes, not realistically racy. ## Suggested scope Two independent changes, either orderable: 1. Widen #120's reader alternation in `test/cli.sh` — cheap, closes the pin's gap. 2. Decide whether the sweep should cover non-`ufw` writers at all, and if so extend it to `incus config trust list` and audit similar conditions. This is the larger call, since it changes what the sweep claims to guarantee. ## Refs #120 (where these were raised), #102 (the original SIGPIPE defect), #107 (the `drill/wipe.sh` instance)