chmod +x a tempdir file then run it - arbitrary code execution the gate cannot classify #9

New issue

Open

opened 2026-05-23 20:53:57 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-23 20:53:57 +00:00

Owner

Originally filed by @coilysiren on 2026-05-21T13:44:01Z - https://github.com/coilysiren/coily/issues/313

Symptom - An agent can run arbitrary code past the gate by writing a file into the tempdir, marking it executable with chmod +x, and executing it directly. No python, uv run, or other interpreter token ever appears on a command line, so the gate's code-execution classifier has nothing to match.

The sequence:

Write tool drops a script at /tmp/foo (file writes are not code execution).
chmod +x /tmp/foo (a benign-looking permission change).
/tmp/foo executes - the gate sees only an opaque path, never the file contents.

Why this matters - This is the same blind spot as coily#312 (coily pkg uv run /tmp/x.py), reached by a different route. coily#312 is about an interpreter verb accepting an arbitrary path. This issue is about direct execution of a chmod'd file: even with every interpreter verb locked down, an agent can still stage and run arbitrary code because the gate classifies command lines, not file contents. The audit trail records /tmp/foo ran, but not what /tmp/foo was.

cli-guard#87 shipped an engine-level arbitrary-code-execution deny. That deny works on recognizable interpreter invocations. A path to a self-contained executable defeats it - there is no interpreter token to recognize.

Expected - Decide the boundary for executing files from outside the repo root. Options to weigh: deny execution of paths under /tmp and other agent-writable temp tiers outright, gate chmod +x on temp-tier paths, or classify file contents at execute time when the target is an agent-written file. Resolve alongside coily#312 and the cli-guard engine deny so all three stay consistent - closing one interpreter verb while leaving direct exec open just moves the hole.

Keywords: chmod +x, tempdir, direct execution, arbitrary code execution, gate blind spot, file-contents not classified, cli-guard engine deny, coily#312

_Originally filed by @coilysiren on 2026-05-21T13:44:01Z - [https://github.com/coilysiren/coily/issues/313](https://github.com/coilysiren/coily/issues/313)_ **Symptom** - An agent can run arbitrary code past the gate by writing a file into the tempdir, marking it executable with `chmod +x`, and executing it directly. No `python`, `uv run`, or other interpreter token ever appears on a command line, so the gate's code-execution classifier has nothing to match. The sequence: 1. `Write` tool drops a script at `/tmp/foo` (file writes are not code execution). 2. `chmod +x /tmp/foo` (a benign-looking permission change). 3. `/tmp/foo` executes - the gate sees only an opaque path, never the file contents. **Why this matters** - This is the same blind spot as coily#312 (`coily pkg uv run /tmp/x.py`), reached by a different route. coily#312 is about an interpreter verb accepting an arbitrary path. This issue is about direct execution of a chmod'd file: even with every interpreter verb locked down, an agent can still stage and run arbitrary code because the gate classifies command lines, not file contents. The audit trail records `/tmp/foo` ran, but not what `/tmp/foo` was. cli-guard#87 shipped an engine-level arbitrary-code-execution deny. That deny works on recognizable interpreter invocations. A path to a self-contained executable defeats it - there is no interpreter token to recognize. **Expected** - Decide the boundary for executing files from outside the repo root. Options to weigh: deny execution of paths under `/tmp` and other agent-writable temp tiers outright, gate `chmod +x` on temp-tier paths, or classify file contents at execute time when the target is an agent-written file. Resolve alongside coily#312 and the cli-guard engine deny so all three stay consistent - closing one interpreter verb while leaving direct exec open just moves the hole. Keywords: chmod +x, tempdir, direct execution, arbitrary code execution, gate blind spot, file-contents not classified, cli-guard engine deny, coily#312

coilysiren added the

label

2026-05-31 01:52:53 +00:00

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

coilyco-bridge/coily#9

No description provided.

Rows
Columns