Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Incident-response SOP's 'Isolate' step (chmod 0500 on <output_dir>) does not stop writes to existing evidence files, subdirectories or open handles (F-W1-DOCS-TRUST-18)

Abierto
  • ¿Algo no está bien?
#881 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
Medio día
Aptitud para principiantes
45/100
Tipo de issue
Documentación
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
shell
Área
documentation, security

Línea de trabajo

Start with step 1 of the isolation procedure in docs/qms/sop_incident_response.md (lines 109-110) and its Turkish mirror docs/qms/sop_incident_response-tr.md (lines 108-109), then check how forgelm/compliance.py:548 opens audit_log.jsonl in append mode. Replace the claim that a directory chmod stops writes with a procedure that stops writers, preserves the chain files with metadata, and names when evidence becomes immutable. Done when both pages are corrected together and the operations owner has walked through the procedure.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

documentation security severity: medium source: review-2026-09 wave: 3

Wave 3 · group W3 Docs · highest severity Medium · 1 finding(s) · effort docs fix

Summary

During an audit-chain incident the runbook tells responders to run chmod 0500 on the output directory "to prevent further writes". A directory's mode only controls creating, renaming and deleting entries in that one directory. The owner can still append to audit_log.jsonl, the files under final_model/ and compliance/ keep their own modes, and processes that already hold a file open keep writing. The runbook calls the evidence isolated while it can still change.

Primary finding

F-W1-DOCS-TRUST-18 — The incident isolation command does not make existing evidence files read-only

severity Medium · confidence high · POSIX permission semantics; no evidence files were modified

What happens. Runbook step 1 in docs/qms/sop_incident_response.md:109-110 (Turkish mirror docs/qms/sop_incident_response-tr.md:108-109). ForgeLM's audit logger opens audit_log.jsonl in append mode for every event (forgelm/compliance.py:548), so the file's own permission bits — not the directory's — decide whether a write succeeds. A non-recursive chmod leaves subdirectories as they were, open descriptors are not re-checked, and privileged users ignore mode bits.

Where.

Evidence (re-verified on 2026-10-09).

Recommended fix. Replace the one-command guarantee with a procedure: stop every writer first (running training or pipeline jobs, schedulers and CI jobs that use the directory); take a forensic copy or storage snapshot that preserves metadata (for example cp -a or rsync -a), including audit_log.jsonl, its .manifest.json sidecar and the compliance and model directories; record SHA-256 hashes of the copy; move it to read-only or write-once storage. State the point at which the evidence becomes immutable. If a permission change stays as an extra step, make it recursive on files and directories and say that it does not stop open handles or privileged users.

Acceptance criteria

  • Neither runbook claims that a directory chmod prevents further writes.
  • The procedure stops writers before preserving evidence, keeps the chain files with their metadata, and names when the evidence becomes immutable.
  • The operations owner has walked through the procedure in a test environment with an active writer.
  • Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
  • The finding is resolved or explicitly closed with a reason.

Found by the September 2026 independent review of ForgeLM against commit cab2947 and re-verified against development at f94595f on 2026-10-09. Code links point at cab2947; line numbers may have moved since. Finding IDs (F-W1-…) are stable references for this backlog.

Lenguaje dominante
Python
Estrellas
9
Forks
1
Merge medio
9 h 14 min
PR fusionados (30 d)
37

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de HodeTech/ForgeLM

Todos los issues de HodeTech/ForgeLM

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.