fix(sandbox): root the fallback runtime tree beneath a validated private anchor

The fallback runtime root moved from a fresh os.MkdirTemp parent to the
predictable <temp>/zero/runtime/v1/<hash> so that elevated setup and the later
command process agree on it. That agreement is required and stays. But a
predictable path directly under the shared system temp is not a private
allocation. On an ordinary shared /tmp another local user can create /tmp/zero
with mode 0700 first, and every affected user then fails before the sandbox
command starts; a pre-existing redirected component makes host-side
preparation lease, create, chmod and clean somewhere other than the derived
tree. Determinism was being used as if it were ownership.

The tree now lives beneath <temp>/zero-runtime-<user>, and that anchor is
created and validated by peermsg.EnsurePrivateDir before anything is built
under it: handle-relative descent, no-follow, refused if any component is a
link or the leaf is not owned by the current user, mode 0700. That primitive
already existed with exactly the semantics jatmn described, so it is exported
and reused rather than written a fourth time. On Unix the uid is in the name
because /tmp is shared; on Windows os.TempDir is already per-user and the
private descriptor plus owner check do the rest.

Validation runs on both paths that can hand back a fallback root:
sandboxRuntimeRootFor returns one itself when the cache lands inside the
workspace, and prepareSandboxRuntime asks for one when the cache root cannot be
leased. Both are covered, each with a junction planted at the anchor, and both
refuse with the junction target untouched; a control shows a clean fallback
still prepares beneath the anchor.

Two things went wrong on the way and are worth recording. The first draft
called pathWithinRoot with its arguments reversed, which asked whether the
anchor was beneath the root, answered false every time, and skipped the
validation entirely while every dependent test reported success through the
junction. And the first lease-failure trigger planted its file at the derived
leaf, so preparation failed on that mkdir before ever reaching the fallback
branch. Both fixed; with validation disabled the two refusal tests now die on
"reported success" while the control stays green.

internal/peermsg/private_dir_other.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 )
 
-func ensurePrivateDir(path string) error {
+func EnsurePrivateDir(path string) error {
 	abs, err := filepath.Abs(path)
 	if err != nil {
 		return err

internal/peermsg/private_dir_unix.go

@@ -12,7 +12,7 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-func ensurePrivateDir(path string) error {
+func EnsurePrivateDir(path string) error {
 	abs, err := filepath.Abs(path)
 	if err != nil {
 		return err

internal/peermsg/private_dir_unix_test.go

@@ -18,7 +18,7 @@ func TestEnsurePrivateDirRejectsSymlink(t *testing.T) {
 	if err := os.Symlink(target, link); err != nil {
 		t.Fatal(err)
 	}
-	if err := ensurePrivateDir(link); err == nil {
+	if err := EnsurePrivateDir(link); err == nil {
 		t.Fatal("expected symlink runtime directory to be rejected")
 	}
 }
@@ -33,7 +33,7 @@ func TestEnsurePrivateDirRejectsSymlinkedParent(t *testing.T) {
 	if err := os.Symlink(target, link); err != nil {
 		t.Fatal(err)
 	}
-	if err := ensurePrivateDir(filepath.Join(link, "peers")); err == nil {
+	if err := EnsurePrivateDir(filepath.Join(link, "peers")); err == nil {
 		t.Fatal("expected symlinked parent to be rejected")
 	}
 }

internal/peermsg/private_dir_windows.go

@@ -12,7 +12,7 @@ import (
 	"golang.org/x/sys/windows"
 )
 
-func ensurePrivateDir(path string) (resultErr error) {
+func EnsurePrivateDir(path string) (resultErr error) {
 	abs, err := filepath.Abs(path)
 	if err != nil {
 		return err

internal/peermsg/private_dir_windows_test.go

@@ -54,7 +54,7 @@ func TestEnsurePrivateDirAppliesOwnerOnlyProtectedDACL(t *testing.T) {
 	if !windowsDirectoryDACLContains(t, path, worldSID) {
 		t.Fatal("test setup did not grant the broad Everyone ACE")
 	}
-	if err := ensurePrivateDir(path); err != nil {
+	if err := EnsurePrivateDir(path); err != nil {
 		t.Fatal(err)
 	}
 	descriptor, err := windows.GetNamedSecurityInfo(
@@ -149,7 +149,7 @@ func windowsDirectoryDACLContains(t *testing.T, path string, wanted *windows.SID
 
 func TestSecurePrivateDirectoryRejectsOwnerMismatch(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "private")
-	if err := ensurePrivateDir(path); err != nil {
+	if err := EnsurePrivateDir(path); err != nil {
 		t.Fatal(err)
 	}
 	handle, err := openWindowsDirectory(path, windows.FILE_LIST_DIRECTORY|windows.FILE_TRAVERSE|windows.SYNCHRONIZE|windows.READ_CONTROL|windows.WRITE_DAC)
@@ -172,7 +172,7 @@ func TestSecurePrivateDirectoryRejectsOwnerMismatch(t *testing.T) {
 
 func TestSecurePrivateDirectoryReportsDACLWriteFailure(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "private")
-	if err := ensurePrivateDir(path); err != nil {
+	if err := EnsurePrivateDir(path); err != nil {
 		t.Fatal(err)
 	}
 	handle, err := openWindowsDirectory(path, windows.FILE_LIST_DIRECTORY|windows.FILE_TRAVERSE|windows.SYNCHRONIZE|windows.READ_CONTROL)
@@ -206,7 +206,7 @@ func TestEnsurePrivateDirRejectsWindowsReparseParent(t *testing.T) {
 	if err := os.Symlink(target, link); err != nil {
 		t.Skipf("cannot create Windows directory symlink: %v", err)
 	}
-	if err := ensurePrivateDir(filepath.Join(link, "peers")); err == nil {
+	if err := EnsurePrivateDir(filepath.Join(link, "peers")); err == nil {
 		t.Fatal("expected reparse-point parent to be rejected")
 	}
 }
@@ -217,7 +217,7 @@ func TestEnsurePrivateDirRejectsWindowsFileComponent(t *testing.T) {
 	if err := os.WriteFile(file, []byte("not a directory"), 0o600); err != nil {
 		t.Fatal(err)
 	}
-	if err := ensurePrivateDir(filepath.Join(file, "peers")); err == nil {
+	if err := EnsurePrivateDir(filepath.Join(file, "peers")); err == nil {
 		t.Fatal("expected file path component to be rejected")
 	}
 }

internal/peermsg/service.go

@@ -158,7 +158,7 @@ func New(options Options) (*Service, error) {
 }
 
 // canonicalRuntimePath normalizes aliases in the existing prefix. It does not
-// establish a security boundary; ensurePrivateDir validates that boundary when
+// establish a security boundary; EnsurePrivateDir validates that boundary when
 // the service starts.
 func canonicalRuntimePath(path string) (string, error) {
 	missing := make([]string, 0, 4)
@@ -219,10 +219,10 @@ func (service *Service) Start(handler Handler) error {
 	if service.closed {
 		return errors.New("peer messaging: service is closed")
 	}
-	if err := ensurePrivateDir(service.root); err != nil {
+	if err := EnsurePrivateDir(service.root); err != nil {
 		return fmt.Errorf("peer messaging: create runtime directory: %w", err)
 	}
-	if err := ensurePrivateDir(service.registryDir()); err != nil {
+	if err := EnsurePrivateDir(service.registryDir()); err != nil {
 		return fmt.Errorf("peer messaging: create registry: %w", err)
 	}
 	endpoint, err := service.transport.Endpoint(service.root, service.nonce, service.pid)

internal/peermsg/transport_unix.go

@@ -44,7 +44,7 @@ func canonicalPrivateDir(path string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	if err := ensurePrivateDir(canonical); err != nil {
+	if err := EnsurePrivateDir(canonical); err != nil {
 		return "", err
 	}
 	return canonical, nil

internal/sandbox/runtime_fallback_anchor_windows_test.go

@@ -0,0 +1,146 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// DETERMINISM IS NOT OWNERSHIP.
+//
+// The fallback runtime root moved from a fresh os.MkdirTemp parent to a
+// predictable name so that elevated setup and the later command agree on it.
+// That is required. But a predictable path beneath the shared system temp is
+// not a private allocation: whatever another local user, or a stray earlier
+// process, has already placed at that name is what preparation then leases,
+// creates, chmods and cleans through. The anchor beneath which the tree lives
+// must therefore be proven to be this user's private directory before anything
+// is built under it, on BOTH paths that can hand back a fallback root.
+//
+// Junctions need no privilege on Windows, so the "attacker-precreated parent"
+// jatmn described is modelled as a junction at the anchor pointing into a
+// directory the test owns and watches. Either trigger must refuse, and the
+// watched directory must stay empty.
+
+// fallbackAnchorFixture redirects TEMP so the anchor lands inside a directory
+// this test owns, plants a junction at the anchor into a watched target, and
+// returns the target. The junction is the shape that defeats a pathname walk:
+// it is not a symlink to os.ModeSymlink, and EvalSymlinks will not traverse it.
+func fallbackAnchorFixture(t *testing.T) (target string) {
+	t.Helper()
+	tempRoot := t.TempDir()
+	target = t.TempDir()
+	t.Setenv("TMP", tempRoot)
+	t.Setenv("TEMP", tempRoot)
+
+	anchor := fallbackRuntimeAnchor()
+	if !strings.HasPrefix(strings.ToLower(anchor), strings.ToLower(tempRoot)) {
+		t.Fatalf("SETUP INVALID: anchor %s is not under the redirected TEMP %s", anchor, tempRoot)
+	}
+	if out, err := exec.Command("cmd", "/c", "mklink", "/J", anchor, target).CombinedOutput(); err != nil {
+		t.Fatalf("mklink /J: %v\n%s", err, out)
+	}
+	return target
+}
+
+func assertNothingUnder(t *testing.T, target string) {
+	t.Helper()
+	entries, err := os.ReadDir(target)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) != 0 {
+		names := make([]string, 0, len(entries))
+		for _, entry := range entries {
+			names = append(names, entry.Name())
+		}
+		t.Errorf("preparation built %v beneath the junction target, which is somebody else's directory", names)
+	}
+}
+
+// Trigger one: the user cache resolves INSIDE the workspace, so
+// sandboxRuntimeRootFor itself returns the fallback root and the first lease
+// attempt is already against it.
+func TestFallbackAnchorIsRefusedWhenTheCacheLandsInsideTheWorkspace(t *testing.T) {
+	target := fallbackAnchorFixture(t)
+	workspace := t.TempDir()
+
+	previous := sandboxUserCacheDir
+	t.Cleanup(func() { sandboxUserCacheDir = previous })
+	sandboxUserCacheDir = func() (string, error) { return filepath.Join(workspace, ".cache"), nil }
+
+	_, release, err := prepareSandboxRuntime(workspace)
+	if err == nil {
+		release()
+		t.Fatal("preparation went through a junction at the fallback anchor and reported success")
+	}
+	if !strings.Contains(err.Error(), "fallback anchor") {
+		t.Errorf("the refusal does not name the anchor, so the operator cannot act on it: %v", err)
+	}
+	assertNothingUnder(t, target)
+}
+
+// Trigger two: the cache root cannot be leased (a FILE sits where the cache
+// runtime tree would go), so preparation falls back explicitly.
+func TestFallbackAnchorIsRefusedWhenTheCacheRootCannotBeLeased(t *testing.T) {
+	target := fallbackAnchorFixture(t)
+	workspace := t.TempDir()
+
+	// Make the cache-derived root unleasable at its ROOT: the user cache is a
+	// regular file, so nothing beneath it can be created and the first lease
+	// fails, which is the path that asks for the fallback explicitly. The
+	// first draft planted the file at the derived leaf instead, and the
+	// preparation failed on that mkdir before ever reaching the fallback
+	// branch, so the trigger under test never fired.
+	cache := filepath.Join(t.TempDir(), "cache-is-a-file")
+	if err := os.WriteFile(cache, []byte("not a directory"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	previous := sandboxUserCacheDir
+	t.Cleanup(func() { sandboxUserCacheDir = previous })
+	sandboxUserCacheDir = func() (string, error) { return cache, nil }
+
+	_, release, err := prepareSandboxRuntime(workspace)
+	if err == nil {
+		release()
+		t.Fatal("preparation fell back through a junction at the anchor and reported success")
+	}
+	if !strings.Contains(err.Error(), "fallback anchor") {
+		t.Errorf("the refusal does not name the anchor: %v", err)
+	}
+	assertNothingUnder(t, target)
+}
+
+// And the honest control: with nothing planted, the fallback prepares, the
+// anchor is a real directory this test can see, and the runtime tree sits
+// beneath it.
+func TestFallbackAnchorIsCreatedPrivatelyWhenNothingIsInTheWay(t *testing.T) {
+	tempRoot := t.TempDir()
+	t.Setenv("TMP", tempRoot)
+	t.Setenv("TEMP", tempRoot)
+	workspace := t.TempDir()
+
+	previous := sandboxUserCacheDir
+	t.Cleanup(func() { sandboxUserCacheDir = previous })
+	sandboxUserCacheDir = func() (string, error) { return filepath.Join(workspace, ".cache"), nil }
+
+	runtimeState, release, err := prepareSandboxRuntime(workspace)
+	if err != nil {
+		t.Fatalf("a clean fallback was refused: %v", err)
+	}
+	defer release()
+
+	anchor := fallbackRuntimeAnchor()
+	info, err := os.Lstat(anchor)
+	if err != nil || !info.IsDir() {
+		t.Fatalf("the anchor was not created as a directory: err=%v", err)
+	}
+	if !pathWithinRoot(anchor, runtimeState.Root) {
+		t.Errorf("runtime root %s is not beneath the anchor %s", runtimeState.Root, anchor)
+	}
+}

internal/sandbox/runtime_state.go

@@ -7,10 +7,14 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"runtime"
 	"sort"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
+
+	"github.com/Gitlawb/zero/internal/peermsg"
 )
 
 var sandboxUserCacheDir = os.UserCacheDir
@@ -81,12 +85,25 @@ func prepareSandboxRuntime(workspaceRoot string) (SandboxRuntime, func(), error)
 	if err != nil {
 		return SandboxRuntime{}, nil, err
 	}
+	// THE ANCHOR IS PROVEN BEFORE THE TREE IS BUILT, on both paths that can
+	// hand back a fallback root: sandboxRuntimeRootFor returns one itself when
+	// the cache lands inside the workspace, and the branch below asks for one
+	// when the cache root cannot be leased. A deterministic name under the
+	// shared temp is only safe beneath a directory this user owns; if the anchor
+	// is a link, or exists and belongs to someone else, this refuses rather than
+	// leasing, creating and chmod-ing through it.
+	if err := ensureFallbackRuntimeAnchor(root); err != nil {
+		return SandboxRuntime{}, nil, err
+	}
 	lease, err := prepareSandboxRuntimeLease(root)
 	if err != nil {
 		root, err = fallbackSandboxRuntimeRoot(workspaceRoot)
 		if err != nil {
 			return SandboxRuntime{}, nil, err
 		}
+		if err := ensureFallbackRuntimeAnchor(root); err != nil {
+			return SandboxRuntime{}, nil, err
+		}
 		lease, err = prepareSandboxRuntimeLease(root)
 		if err != nil {
 			return SandboxRuntime{}, nil, err
@@ -201,6 +218,63 @@ func combineSandboxCleanups(cleanups ...func()) func() {
 	}
 }
 
+// fallbackRuntimeAnchor is the per-user directory the deterministic fallback
+// runtime tree lives beneath.
+//
+// DETERMINISM IS NOT OWNERSHIP. The fallback moved from a fresh, private
+// os.MkdirTemp parent to a predictable name so that elevated setup and the
+// later command process agree on the runtime root. That agreement is required
+// and must stay. But a predictable path directly under the shared system temp
+// is not a private allocation: on an ordinary shared /tmp another local user
+// can create /tmp/zero with mode 0700 first, and every affected user then fails
+// before the sandbox command starts; a pre-existing redirected component makes
+// host-side preparation operate somewhere other than the derived tree.
+//
+// So the tree is rooted beneath an anchor that names THIS user, and the anchor
+// is created and validated by peermsg.EnsurePrivateDir before anything is
+// built under it: handle-relative descent, no-follow, refused if any component
+// is a link or the leaf is not owned by the current user, mode 0700. On Unix
+// the uid is in the name because /tmp is shared between users; on Windows
+// os.TempDir is already per-user, and the private descriptor plus the owner
+// check do the rest.
+func fallbackRuntimeAnchor() string {
+	tag := "user"
+	if runtime.GOOS != "windows" {
+		tag = strconv.Itoa(os.Getuid())
+	}
+	return filepath.Join(os.TempDir(), "zero-runtime-"+tag)
+}
+
+// isFallbackRuntimeRoot reports whether root was derived by
+// fallbackSandboxRuntimeRoot, so the caller knows the anchor must be validated
+// before the tree beneath it is prepared. Both candidates a command derives can
+// be fallback roots: sandboxRuntimeRootFor returns one itself when the cache
+// lands inside the workspace, and prepareSandboxRuntime asks for one when the
+// cache root cannot be leased.
+func isFallbackRuntimeRoot(root string) bool {
+	// pathWithinRoot(parent, child): is root beneath the anchor. The first
+	// draft had these reversed, which asked whether the anchor was beneath the
+	// root, answered false every time, and skipped the validation entirely
+	// while every test that depended on it reported success through a
+	// junction. Argument order is the whole function.
+	return pathWithinRoot(fallbackRuntimeAnchor(), root)
+}
+
+// ensureFallbackRuntimeAnchor validates the anchor beneath which a fallback
+// runtime tree is about to be built, and fails closed. Called only when the
+// root is a fallback root; the cache-derived root lives under the user cache,
+// which is already the user's own directory.
+func ensureFallbackRuntimeAnchor(root string) error {
+	if !isFallbackRuntimeRoot(root) {
+		return nil
+	}
+	anchor := fallbackRuntimeAnchor()
+	if err := peermsg.EnsurePrivateDir(anchor); err != nil {
+		return fmt.Errorf("sandbox runtime fallback anchor %s is not a private directory owned by this user: %w", anchor, err)
+	}
+	return nil
+}
+
 // fallbackSandboxRuntimeRoot returns the runtime root for a workspace whose
 // cache-derived root would land inside itself.
 //
@@ -222,7 +296,7 @@ func combineSandboxCleanups(cleanups ...func()) func() {
 // a tree without materializing it now holds for the fallback as well.
 func fallbackSandboxRuntimeRoot(workspaceRoot string) (string, error) {
 	digest := sha256.Sum256([]byte(workspaceRoot))
-	root := filepath.Join(os.TempDir(), "zero", "runtime", "v1", hex.EncodeToString(digest[:8]))
+	root := filepath.Join(fallbackRuntimeAnchor(), "v1", hex.EncodeToString(digest[:8]))
 	if pathWithinRoot(workspaceRoot, root) {
 		// Both candidates land inside the workspace, so there is nowhere left to
 		// put a runtime tree the workspace's own policy does not govern. Refused