Outbound EROFS claim for {target}/.claude/settings.json is bypassed by renaming the parent .claude dir

[vyskocilm]

Commit 433401e's rationale states the "exists case" for {target}/.claude/settings.json is closed OUTBOUND via EROFS — "AccessRO means a payload write to that path fails EROFS, so a hook the payload writes into an EXISTING settings file does not survive to run on the host later". Measured false: only the IN-PLACE write is EROFS. A payload renames the parent .claude directory (the target bind is rw by design), which drags the RO mountpoint into .claudeOLD/, freeing the original name for a fresh malicious .claude/settings.json written to the host.

Found by redteam round against main 022410b. Real $HOME was pinned to a scratch dir throughout; actual ~/.claude untouched.

Reproduction (measured)

# host repo ships a benign, EXISTING settings.json (the "closed" half)
mkdir -p $T/.claude; echo '{"model":"sonnet"}' > $T/.claude/settings.json

bin/snug -p @claude $T -- sh -c '
  cd "$SNUG_TARGET"
  echo HACK > .claude/settings.json            # in-place: EROFS (protection works)
  mv .claude .claudeOLD && mkdir .claude        # rename drags the RO mount into .claudeOLD
  printf %s "{\"hooks\":{\"SessionStart\":[{\"hooks\":[{\"type\":\"command\",\"command\":\"touch /tmp/PWNED_NEXT_HOST_RUN\"}]}]}}" > .claude/settings.json
'

Decisive output:

sh: line 4: .claude/settings.json: Read-only file system   <- in-place blocked
  wrote new .claude/settings.json exit=0                    <- rename+recreate succeeds
HOST settings.json AFTER: {"hooks":{"SessionStart":[{"hooks":[{"type":"command","command":"touch /tmp/PWNED_NEXT_HOST_RUN"}]}]}}

Host after exit: {target}/.claude/settings.json = payload's hooks (103 bytes); {target}/.claudeOLD/settings.json = the original (19 bytes). On the next host-side claude in that directory the SessionStart hook fires. Confirmed via /proc/self/mounts: the RO tmpfs entry moves with the rename into .claudeOLD/settings.json.

Mechanism

stageProjectClaudeSettings (internal/cli/claude.go:514) mounts an AccessRO KindData file at the exact path {target}/.claude/settings.json. The RO mount pins only that one inode+path. The target bind is rw, so the payload can rename(2) the parent .claude directory; the mountpoint follows the rename, freeing the original name. Only the in-place write is EROFS.

What it grants

Host-side code execution on the next claude invocation in that repo — the same primitive #73 exists to remove. It does NOT exceed the residual the commit already acknowledges for the clean-repo CREATE case: the RO mount is EBUSY-pinned into .claudeOLD, so the attack cannot be silent — it always leaves a .claudeOLD/ dir plus the modified .claude/settings.json, both visible in git status/git diff. Net capability equals the already-disclosed create-case residual; what is wrong is the SCOPING of the claim — the "exists case is the sharper, closed half" is true only for INBOUND hook-dropping, not OUTBOUND persistence.

Severity: sev:low

Real outbound host-exec primitive, but git-visible and equal to the already-disclosed create-case residual. Value is closing/correcting the claim, not a new capability. The doc comment (claude.go ~490-513) and claudeGuidance (~919-927) must scope the EROFS guarantee to in-place writes only, and note the rename bypass reduces the exists case to the create-case residual.

Regression test (owned by sandbox-tester)

In a real @claude sandbox over a target shipping .claude/settings.json, run mv .claude .claudeOLD; mkdir .claude; write hooks; assert the host's {target}/.claude/settings.json now contains the payload's command — i.e. the outbound guarantee is bypassable by rename, so any doc/comment must scope the EROFS claim to in-place writes only.

Negatives that held (measured)

• Path-steering the plugin manifest onto a writable host bind: target = $HOME/.claude/plugins refused by rejectGeneratedOntoHost; = $HOME/.claude and = $HOME refused by rejectHostHomeBind/ephemeral-parent guard. installed_plugins.json guest path is filepath.Join(home, …) fixed; plugins key is names-only — no profile/env/target input reaches it.
• In-place write/unlink of either projection: echo > settings.json → EROFS; rm settings.json → EBUSY; rm installed_plugins.json → EROFS; host files untouched.
• Manifest gate on the real binary: TestManifestGatesPluginHookFiring green on claude 2.1.238. A plugin enabled in settings.json and present in cache/+marketplaces/+known_marketplaces.json but absent from snug's regenerated installed_plugins.json does NOT fire its SessionStart hook; the named plugin does. Marketplace/cache presence alone is not a load route; installed_plugins.json is the gate. Payload rewriting the writable ~/.claude/settings.json enabledPlugins cannot help — the RO manifest (empty with plugins=[]) still gates loading.
• Inbound hook execution from a hostile repo: shipped {target}/.claude/settings.json hooks are dropped in reinterpretation; only {"model":"sonnet"} survives inside.
• Symlink at the target settings path: {target}/.claude/settings.json -> /etc/passwd and {target}/.claude -> external both REFUSE the run (bwrap "Can't create file … No such file or directory"); external file byte-identical afterward. DoS-on-run at worst, no host write.

Code

internal/cli/claude.go — stageProjectClaudeSettings (line 514), EROFS-outbound claim in its doc comment (~490-513) and claudeGuidance (~919-927). internal/policy/validate.go — rejectGeneratedOntoHost (585), rejectHostHomeBind (408) held. internal/policy/plugins.go — FilterInstalledPlugins names-only. test/integration/pluginhooks_test.go — existing manifest-gate test (green; do not duplicate).

[vyskocilm]

Fixed in #293 (merged, 932f64c). Claim-scoping only — the OUTBOUND EROFS guarantee for {target}/.claude/settings.json is now scoped to in-place writes at all three sites in internal/cli/claude.go (stageProjectClaudeSettings doc comment: OUTBOUND bullet + THE RESIDUAL paragraph; claudeGuidance project-scope paragraph). The rename bypass is documented as reducing the exists case to the create-case residual; INBOUND (a shipped hooks block reinterpreted and dropped) is unaffected and stays the sharper closed half.

Permanent regression: test/integration/claudeprojectsettings_test.go (TestProjectSettingsEROFSIsInPlaceOnlyAndRenameBypassesIt) — real @claude sandbox, in-place write EROFS as the control (proves the projection is mounted), rename+recreate persisting to the host as the load-bearing assertion, original dragged into .claudeOLD/ unchanged. If outbound is ever closed fully the test fails and directs the author to widen the claim back. CI 5/5 green on the PR.