#566 [security][tools] Bash の書き込み検査が env・sudo・timeout などの前置きや { … } の中の書き込みを認識せず、ワークスペース外へ書き込める（#509 の調査で発見）

[Kewton]

What changed

• src/tools/bash_write_guard/command_prefix.rs (new): peels command prefixes before choosing the program whose write targets are checked.
  • Process prefixes: env, command, builtin, exec, nohup, sudo/doas/sudoedit, timeout/gtimeout, nice, ionice, stdbuf, time and /usr/bin/time, setsid, caffeinate, arch.
  • Shell syntax: !, {/}, the reserved words, and function NAME.
  • Options that take a value are skipped explicitly.
  • Peeling repeats up to a depth limit of 16.
• If a prefix cannot be resolved, the remaining words are scanned. The command is rejected when the scan finds a write program or another prefix. This is honest failure: no blanket rejection. Examples of unresolvable prefixes:
  • an unknown option
  • a prefix that changes the working directory or the shell (env -C, --chdir, sudo -s/-i/-D/-R)
  • a chain deeper than the limit
• env -S / --split-string is rejected in every spelling:
  • short option clusters that contain S (-S, -iS, -vS…)
  • every prefix of --split-string (--s … --split-string)
  • this applies after unresolvable options too, because env re-splits, unquotes and expands that string.
• Write targets added: sudo -e/sudoedit operands and /usr/bin/time -o FILE.
• src/tools/bash_write_guard.rs: wires the resolved program into write_targets, confinement_rejection (new rejection reasons), and the shared extraction. has_recognized_mutation and protected_path_mutation use that extraction.
• tests/issue566_bash_command_prefix_write_targets.rs (new): integration tests through path_confinement_rejection.

Verification

• Runner verify: 15/15 pass on dbc19a3f (commandmate verify --task).
• Before/after: the new rejection rows fail on the earlier code and pass with this change. This was checked for each fix round: the original fix, the review fixes B1–B4, R1/R2, and E1–E3.
• cargo mutants on command_prefix.rs, measured with --jobs 1 re-runs:
  • All survivors were classified.
  • The remaining survivors are equivalent: they reach the same Undecidable/NoExecution result through a later branch.
  • Timeouts are non-terminating loop mutants.
• Merge-gate review (Claude_Sub):
  • The first review found 4 blockers. Two rechecks found 2 more and then 3 more, all in env -S spellings.
  • All were fixed. The final recheck (H-05) reports 0 blockers.
  • About 330 earlier table rows were re-run: 0 changed from REJECT to ALLOW.
• Unchanged and still passing: issue567_bash_glob_write_targets, issue428_bash_path_tokens, bash_workspace_confinement.

Notes

• Every behavior change is stricter.
  • env tee out.txt and timeout 5 tee out.txt now count as writes, so bash:verify no longer auto-allows them.
  • The auto-allow of verification commands is unchanged: timeout 600 cargo test, env RUST_LOG=debug cargo test, nice cargo build, npm test, …
  • Event names and schemas are unchanged.
• Conservative false rejections:
  • env -S'cargo test' and other uses of env -S
  • sudo -S after an unresolvable option
  • an option cluster whose S is really a value (env -iuS …)
• Out of scope:
  • xargs, find -exec, sh -c, eval, su -c, watch, script -c ([security][tools] Bash の字句検査では、プログラム経由の間接書き込みや検証コマンドの副作用を閉じ込められない #502)
  • prefixes that are not in the table (chrt, taskset, unshare, busybox)
  • ANSI-C quoting $'…' in the lexer (pre-existing, tracked separately)
• Not implemented yet: the distinction between exec prefixes and shell prefixes (design 5). It moves to [security][tools] Bash の書き込み検査が同じコマンドの cd・pushd の後の cwd を追わず、symlink を通ってワークスペース外へ書き込める（#509 の調査で発見） #568, which is the first change that needs it. Today cd is recorded after either kind, which is the strict side.
• Related: [security][tools] Bash の書き込み検査が >| と数字でない >& を redirect として読まず、ワークスペース外へ書き込める（#509 の調査で発見） #565, [security][tools] Bash の書き込み先の glob・brace を展開前の文字列で判定するため、中の symlink を通ってワークスペース外へ書き込める（#509 の調査で発見） #567, [security][tools] Bash の書き込み検査が同じコマンドの cd・pushd の後の cwd を追わず、symlink を通ってワークスペース外へ書き込める（#509 の調査で発見） #568, [security][tools] Bash の 2 段目の読み取りの判定が、引用符のない glob・動的な値・glob を含む絶対パスで抜け、ワークスペース外を読める（#567 の調査で発見） #571, [security][tools] Bash の字句検査では、プログラム経由の間接書き込みや検証コマンドの副作用を閉じ込められない #502.

Developed with the CommandMate parallel-dev harness (PM: Claude Code, leader: Claude_Dev, workers: Command Code).

🤖 Generated with Claude Code