Skip to content

run-gate0.sh fails 263/366 in a default environment — two independent trust-root permission conditions #4

Description

@ilyeji

Environment: GCP c3-standard-4 Intel TDX CVM, Ubuntu 24.04.4, Python 3.12.3, cathedral-cli@a663cdb.

As documented:

./run-gate0.sh
→ 263 failed, 103 passed, 46 errors in 569s

250 of the failures share one cause. _owner_ok (release_lock.py:143) requires no group/other write, checked against every ancestor, and reports the first one that fails:

return info.st_uid in (0, os.geteuid()) and not (info.st_mode & 0o022)

Two conditions fail independently, which is what makes this confusing to diagnose:

  1. The fixture's trust-root dir inherits the process umask. tempfile.mkdtemp() gives 0700, but the keys subdir is created with a plain mkdir(), so under Ubuntu's default umask 002 it lands 0775 — group-writable. run-gate0.sh sets no umask (grep -c umask run-gate0.sh → 0).
  2. /tmp itself is 1777 and always fails the same check, so correcting the umask alone just moves the error one level up to /tmp.

Observed directly:

/tmp/probe-XXXX        0700  owner_ok=True
/tmp/probe-XXXX/keys   0775  owner_ok=False     ← umask 002

umask 022 → error becomes:
  "revocation trust root: /tmp is foreign-owned or writable by others"

Fixing either one alone still fails. With both (umask 022 + a non-world-writable TMPDIR):

21 failed, 345 passed in 2402s

Suggested fix: build fixture permissions with an explicit chmod rather than relying on the umask, and have the fixture root live somewhere not under a world-writable ancestor (or have run-gate0.sh set both). This is the same class as cathedral-compute#83.

Note on runtime: the corrected run takes ~40 min vs ~9.5 min, because the tests actually execute instead of erroring out during setup. Worth knowing before anyone assumes a long run is hung.

Residual 21 failures after the environment fix — filed separately where diagnosed:

  • 3 × TestSecretHandling → see the secret set crash issue
  • 2 × TOML rendering/escaping → see the config corruption issue
  • The rest are config-contract mismatches I have not diagnosed: burn_fraction is settable as an operator setting while test_burn_is_not_offered_as_an_operator_setting asserts it must not be; require_policy absent from the declared owner-controlled fields; KeyError: 'weight_policy_key'.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions