Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Incident-response SOP's 'Isolate' step (chmod 0500 on <output_dir>) does not stop writes to existing evidence files, subdirectories or open handles (F-W1-DOCS-TRUST-18)

未关闭
  • 哪里不对？
#881 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
半天
新手友好度
45/100
Issue 类型
文档
描述清晰度
基本清楚
活跃度
活跃
技术栈
shell
领域
documentation, security

调研方向

Start with step 1 of the isolation procedure in docs/qms/sop_incident_response.md (lines 109-110) and its Turkish mirror docs/qms/sop_incident_response-tr.md (lines 108-109), then check how forgelm/compliance.py:548 opens audit_log.jsonl in append mode. Replace the claim that a directory chmod stops writes with a procedure that stops writers, preserves the chain files with metadata, and names when evidence becomes immutable. Done when both pages are corrected together and the operations owner has walked through the procedure.

由索引模型根据 Issue 内容生成。

描述

documentation security severity: medium source: review-2026-09 wave: 3

Wave 3 · group W3 Docs · highest severity Medium · 1 finding(s) · effort docs fix

Summary

During an audit-chain incident the runbook tells responders to run chmod 0500 on the output directory "to prevent further writes". A directory's mode only controls creating, renaming and deleting entries in that one directory. The owner can still append to audit_log.jsonl, the files under final_model/ and compliance/ keep their own modes, and processes that already hold a file open keep writing. The runbook calls the evidence isolated while it can still change.

Primary finding

F-W1-DOCS-TRUST-18 — The incident isolation command does not make existing evidence files read-only

severity Medium · confidence high · POSIX permission semantics; no evidence files were modified

What happens. Runbook step 1 in docs/qms/sop_incident_response.md:109-110 (Turkish mirror docs/qms/sop_incident_response-tr.md:108-109). ForgeLM's audit logger opens audit_log.jsonl in append mode for every event (forgelm/compliance.py:548), so the file's own permission bits — not the directory's — decide whether a write succeeds. A non-recursive chmod leaves subdirectories as they were, open descriptors are not re-checked, and privileged users ignore mode bits.

Where.

Evidence (re-verified on 2026-10-09).

Recommended fix. Replace the one-command guarantee with a procedure: stop every writer first (running training or pipeline jobs, schedulers and CI jobs that use the directory); take a forensic copy or storage snapshot that preserves metadata (for example cp -a or rsync -a), including audit_log.jsonl, its .manifest.json sidecar and the compliance and model directories; record SHA-256 hashes of the copy; move it to read-only or write-once storage. State the point at which the evidence becomes immutable. If a permission change stays as an extra step, make it recursive on files and directories and say that it does not stop open handles or privileged users.

Acceptance criteria

  • Neither runbook claims that a directory chmod prevents further writes.
  • The procedure stops writers before preserving evidence, keeps the chain files with their metadata, and names when the evidence becomes immutable.
  • The operations owner has walked through the procedure in a test environment with an active writer.
  • Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
  • The finding is resolved or explicitly closed with a reason.

Found by the September 2026 independent review of ForgeLM against commit cab2947 and re-verified against development at f94595f on 2026-10-09. Code links point at cab2947; line numbers may have moved since. Finding IDs (F-W1-…) are stable references for this backlog.

主要语言
Python
星标
9
派生
1
平均合并
7 小时 53 分钟
30 天内合并 PR
58

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

HodeTech/ForgeLM 的其他 Issue

查看 HodeTech/ForgeLM 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。