🛡️ Sentinel: [CRITICAL] Fix insecure file logging vulnerable to TOCTOU symlink attacks

.jules/sentinel.md

@@ -31,3 +31,7 @@
 **Vulnerability:** External shell command executed in `listLocalSnapshots()` triggered a deadlock when `tmutil` output exceeded 64KB, because stdout and stderr were read synchronously inside the process termination handler.
 **Learning:** In Swift, reading from a process pipe synchronously inside a `terminationHandler` can result in a permanent deadlock if the child blocks writing to a full pipe, preventing it from exiting.
 **Prevention:** Asynchronously drain pipes continuously while the process is running using background queues.
+## 2026-05-02 - TOCTOU Symlink Attack via High-Level File APIs
+**Vulnerability:** Found `FileHandle(forWritingTo:)` and `String.write(to:atomically:)` used for file logging.
+**Learning:** These APIs follow symlinks by default. If an attacker pre-creates the log file as a symlink, they can arbitrarily overwrite files or escalate privileges.
+**Prevention:** Use POSIX `open()` with `O_CREAT | O_WRONLY | O_APPEND | O_NOFOLLOW | O_CLOEXEC` to securely refuse symlinks when logging or creating files.

Sources/Cacheout/Cleaner/CacheCleaner.swift

@@ -34,6 +34,7 @@
 
 import Foundation
 import AppKit
+import Darwin
 
 actor CacheCleaner {
     private let fileManager = FileManager.default
@@ -260,13 +261,22 @@ actor CacheCleaner {
         let logFile = logDir.appendingPathComponent("cleanup.log")
         let size = ByteCountFormatter.sharedFile.string(fromByteCount: bytesFreed)
         let entry = "[\(ISO8601DateFormatter.shared.string(from: Date()))] Cleaned \(category): \(size)\n"
+        let data = entry.data(using: .utf8) ?? Data()
 
-        if let handle = try? FileHandle(forWritingTo: logFile) {
-            handle.seekToEndOfFile()
-            handle.write(entry.data(using: .utf8) ?? Data())
-            handle.closeFile()
-        } else {
-            try? entry.write(to: logFile, atomically: true, encoding: .utf8)
+        _ = logFile.withUnsafeFileSystemRepresentation { pathPtr -> Int32 in
+            guard let ptr = pathPtr else { return -1 }
+            let fd = open(ptr, O_CREAT | O_WRONLY | O_APPEND | O_NOFOLLOW | O_CLOEXEC, 0o600)
+            if fd != -1 {
+                let handle = FileHandle(fileDescriptor: fd, closeOnDealloc: true)
+                if #available(macOS 10.15.4, *) {
+                    try? handle.write(contentsOf: data)
+                    try? handle.close()
+                } else {
+                    handle.write(data)
+                    handle.closeFile()
+                }
+            }
+            return fd
         }
     }
 }