From a64c0207916eb7b558483bd319def14bb9d98919 Mon Sep 17 00:00:00 2001 From: chaodu-agent Date: Mon, 5 Oct 2026 20:43:43 +0000 Subject: [PATCH] docs(cron): drop unsafe shared-writable directory advice The writeback temp file name is fixed (cronjob.toml.tmp) and is not created with O_EXCL, so an agent can pre-create it in a shared-writable directory and end up owning the renamed file; a sticky bit does not prevent that. Require a directory the agent cannot write instead. --- docs/cronjob.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/cronjob.md b/docs/cronjob.md index 653d52e76..ca03ff27e 100644 --- a/docs/cronjob.md +++ b/docs/cronjob.md @@ -362,7 +362,7 @@ Prompts and `disable_on_success` live in the same file, so write access cannot b - **Full autonomy**: enable usercron and let the agent manage `cronjob.toml`. Best for a personal agent whose inputs you trust. - **Operator-managed only**: leave `usercron_enabled = false` and put schedules in baseline `[[cron.jobs]]`, or keep usercron but make the file unwritable by the agent at the filesystem level. By default the agent runs as the same OS user as OpenAB, so anything the agent cannot write, OpenAB cannot write either, unless you run them as different users. Options: - A read-only mount or a Kubernetes ConfigMap. OpenAB cannot write the file either. - - A file **and** containing directory owned by a different user than the agent runs as. Write access to the directory alone is enough to replace the file, so making only the file read-only protects nothing. If the directory is shared-writable (such as `/tmp`), also set the sticky bit. + - A file **and** containing directory owned by a different user than the agent runs as. Write access to the directory alone is enough to replace the file, so making only the file read-only protects nothing. The containing directory must not be writable by the agent; do not use a shared-writable directory such as `/tmp`. `usercron_path` may be absolute, so protect the file and directory it actually points to. Agent CLI path rules alone are not enough, because an agent with a shell tool can bypass them.