fix(askpass): a SIGKILL can leave the 0700 GIT_ASKPASS helper in TMPDIR until reboot #847

New issue

Open

opened 2026-10-20 17:17:54 +00:00 by hexajon · 0 comments

hexajon commented

2026-10-20 17:17:54 +00:00

Owner

What happens

madtea writes its GIT_ASKPASS helper as a 0700 file in $TMPDIR and removes it with a signal handler on exit. An uncatchable kill (SIGKILL, a crash, a power loss) bypasses that handler, so the helper stays in $TMPDIR until the OS clears it, often not until reboot. It is owner-only readable, so the exposure is small, but orphaned helpers accumulate across such deaths.

Why it matters

The helper is part of the credential-passing path (ADR 0013): the token reaches git through GIT_ASKPASS, never on argv. The on-exit cleanup covers the normal case, but an uncatchable signal leaves a predictable, owner-owned artifact behind. It is hygiene, not a token on disk, but a leftover that outlives the process is worth clearing.

Fix

Sweep stale madtea askpass helpers before writing a new one: on startup, or at the point the next helper is created, remove the owner-owned madtea askpass files a prior run left behind. Keep the on-exit signal-handler cleanup as the primary path; the sweep only covers the uncatchable-kill case.

Acceptance criteria

A madtea run removes its own stale askpass helper left by a prior process that died to an uncatchable signal.
The on-exit signal-handler cleanup is unchanged for the normal case.
A test plants an orphan helper and asserts the next run removes it.

ADR 0013 (credential storage model; the GIT_ASKPASS path).

## What happens madtea writes its `GIT_ASKPASS` helper as a 0700 file in `$TMPDIR` and removes it with a signal handler on exit. An uncatchable kill (SIGKILL, a crash, a power loss) bypasses that handler, so the helper stays in `$TMPDIR` until the OS clears it, often not until reboot. It is owner-only readable, so the exposure is small, but orphaned helpers accumulate across such deaths. ## Why it matters The helper is part of the credential-passing path (ADR 0013): the token reaches git through `GIT_ASKPASS`, never on argv. The on-exit cleanup covers the normal case, but an uncatchable signal leaves a predictable, owner-owned artifact behind. It is hygiene, not a token on disk, but a leftover that outlives the process is worth clearing. ## Fix Sweep stale madtea askpass helpers before writing a new one: on startup, or at the point the next helper is created, remove the owner-owned madtea askpass files a prior run left behind. Keep the on-exit signal-handler cleanup as the primary path; the sweep only covers the uncatchable-kill case. ## Acceptance criteria - A madtea run removes its own stale askpass helper left by a prior process that died to an uncatchable signal. - The on-exit signal-handler cleanup is unchanged for the normal case. - A test plants an orphan helper and asserts the next run removes it. ## Related - ADR 0013 (credential storage model; the GIT_ASKPASS path).

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#847

No description provided.

Rows
Columns