Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Incident-response SOP's 'Isolate' step (chmod 0500 on <output_dir>) does not stop writes to existing evidence files, subdirectories or open handles (F-W1-DOCS-TRUST-18)

Open
  • Is something wrong?
#881 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
Half a day
Newbie friendliness
45/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Active
Tech stack
shell
Domain
documentation, security

Research direction

Start with step 1 of the isolation procedure in docs/qms/sop_incident_response.md (lines 109-110) and its Turkish mirror docs/qms/sop_incident_response-tr.md (lines 108-109), then check how forgelm/compliance.py:548 opens audit_log.jsonl in append mode. Replace the claim that a directory chmod stops writes with a procedure that stops writers, preserves the chain files with metadata, and names when evidence becomes immutable. Done when both pages are corrected together and the operations owner has walked through the procedure.

Written by the indexing model from the issue text.

Description

documentation security severity: medium source: review-2026-09 wave: 3

Wave 3 · group W3 Docs · highest severity Medium · 1 finding(s) · effort docs fix

Summary

During an audit-chain incident the runbook tells responders to run chmod 0500 on the output directory "to prevent further writes". A directory's mode only controls creating, renaming and deleting entries in that one directory. The owner can still append to audit_log.jsonl, the files under final_model/ and compliance/ keep their own modes, and processes that already hold a file open keep writing. The runbook calls the evidence isolated while it can still change.

Primary finding

F-W1-DOCS-TRUST-18 — The incident isolation command does not make existing evidence files read-only

severity Medium · confidence high · POSIX permission semantics; no evidence files were modified

What happens. Runbook step 1 in docs/qms/sop_incident_response.md:109-110 (Turkish mirror docs/qms/sop_incident_response-tr.md:108-109). ForgeLM's audit logger opens audit_log.jsonl in append mode for every event (forgelm/compliance.py:548), so the file's own permission bits — not the directory's — decide whether a write succeeds. A non-recursive chmod leaves subdirectories as they were, open descriptors are not re-checked, and privileged users ignore mode bits.

Where.

Evidence (re-verified on 2026-10-09).

Recommended fix. Replace the one-command guarantee with a procedure: stop every writer first (running training or pipeline jobs, schedulers and CI jobs that use the directory); take a forensic copy or storage snapshot that preserves metadata (for example cp -a or rsync -a), including audit_log.jsonl, its .manifest.json sidecar and the compliance and model directories; record SHA-256 hashes of the copy; move it to read-only or write-once storage. State the point at which the evidence becomes immutable. If a permission change stays as an extra step, make it recursive on files and directories and say that it does not stop open handles or privileged users.

Acceptance criteria

  • Neither runbook claims that a directory chmod prevents further writes.
  • The procedure stops writers before preserving evidence, keeps the chain files with their metadata, and names when the evidence becomes immutable.
  • The operations owner has walked through the procedure in a test environment with an active writer.
  • Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
  • The finding is resolved or explicitly closed with a reason.

Found by the September 2026 independent review of ForgeLM against commit cab2947 and re-verified against development at f94595f on 2026-10-09. Code links point at cab2947; line numbers may have moved since. Finding IDs (F-W1-…) are stable references for this backlog.

Dominant language
Python
Stars
9
Forks
1
Avg merge
8h 10m
Merged PRs (30d)
5

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from HodeTech/ForgeLM

All issues in HodeTech/ForgeLM

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.