Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Incident-response SOP's 'Isolate' step (chmod 0500 on <output_dir>) does not stop writes to existing evidence files, subdirectories or open handles (F-W1-DOCS-TRUST-18)

オープン
  • 何か問題がありますか？
#881 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
半日
初心者へのやさしさ
45/100
issue の種類
ドキュメント
明瞭さ
おおむね明確
活発さ
活発
技術スタック
shell
領域
documentation, security

調査の方向性

Start with step 1 of the isolation procedure in docs/qms/sop_incident_response.md (lines 109-110) and its Turkish mirror docs/qms/sop_incident_response-tr.md (lines 108-109), then check how forgelm/compliance.py:548 opens audit_log.jsonl in append mode. Replace the claim that a directory chmod stops writes with a procedure that stops writers, preserves the chain files with metadata, and names when evidence becomes immutable. Done when both pages are corrected together and the operations owner has walked through the procedure.

索引モデルが issue の本文から書いたものです。

説明

documentation security severity: medium source: review-2026-09 wave: 3

Wave 3 · group W3 Docs · highest severity Medium · 1 finding(s) · effort docs fix

Summary

During an audit-chain incident the runbook tells responders to run chmod 0500 on the output directory "to prevent further writes". A directory's mode only controls creating, renaming and deleting entries in that one directory. The owner can still append to audit_log.jsonl, the files under final_model/ and compliance/ keep their own modes, and processes that already hold a file open keep writing. The runbook calls the evidence isolated while it can still change.

Primary finding

F-W1-DOCS-TRUST-18 — The incident isolation command does not make existing evidence files read-only

severity Medium · confidence high · POSIX permission semantics; no evidence files were modified

What happens. Runbook step 1 in docs/qms/sop_incident_response.md:109-110 (Turkish mirror docs/qms/sop_incident_response-tr.md:108-109). ForgeLM's audit logger opens audit_log.jsonl in append mode for every event (forgelm/compliance.py:548), so the file's own permission bits — not the directory's — decide whether a write succeeds. A non-recursive chmod leaves subdirectories as they were, open descriptors are not re-checked, and privileged users ignore mode bits.

Where.

Evidence (re-verified on 2026-10-09).

Recommended fix. Replace the one-command guarantee with a procedure: stop every writer first (running training or pipeline jobs, schedulers and CI jobs that use the directory); take a forensic copy or storage snapshot that preserves metadata (for example cp -a or rsync -a), including audit_log.jsonl, its .manifest.json sidecar and the compliance and model directories; record SHA-256 hashes of the copy; move it to read-only or write-once storage. State the point at which the evidence becomes immutable. If a permission change stays as an extra step, make it recursive on files and directories and say that it does not stop open handles or privileged users.

Acceptance criteria

  • Neither runbook claims that a directory chmod prevents further writes.
  • The procedure stops writers before preserving evidence, keeps the chain files with their metadata, and names when the evidence becomes immutable.
  • The operations owner has walked through the procedure in a test environment with an active writer.
  • Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
  • The finding is resolved or explicitly closed with a reason.

Found by the September 2026 independent review of ForgeLM against commit cab2947 and re-verified against development at f94595f on 2026-10-09. Code links point at cab2947; line numbers may have moved since. Finding IDs (F-W1-…) are stable references for this backlog.

主要言語
Python
スター
9
フォーク
1
平均マージ
8時間 10分
マージ済み PR（30日）
5

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

HodeTech/ForgeLM のほかの issue

HodeTech/ForgeLM の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。