fix: audit 2026-10-09 - rclone rc on a private socket, fail-closed remote check, lost process output

[mbeczynski]

Fixes the findings of the 9 Oct 2026 audit: K1, W1-W3, S1-S5 and the cheap LOW items. Each fix comes with a regression test. Every test was checked against the old behaviour: I reverted each fix in turn and confirmed its tests fail (results below).

K1 (critical): rclone remote control on a private socket

What was wrong. rclone mount listened on 127.0.0.1:5572 with --rc-no-auth, and the mount runs with --drive-use-trash=false. Loopback does not keep web pages out:

• A page can send a form POST to it without a CORS preflight.
• rclone does not check Origin.
• So any page open in the browser could call operations/purge on gdrive:CloudMachine/<folder>, and the delete would be permanent.

The audit confirmed this against the running mount: config/listremotes answered a form POST sent with Origin: https://evil.example.

Fix

• The mount now listens on --rc-addr unix://~/.cloudmachine/run/rc.sock, in a directory set to 0700 (re-applied on every start).
  • A browser cannot reach a unix socket at all.
  • Other users cannot enter the directory.
  • Checked by hand on rclone 1.75.1 with a throwaway rclone rcd in /tmp: the socket works, and the client reaches it with rclone rc --unix-socket.
• One way in. Every caller goes through DriveBufferService.rc(...). That covers vfs/stats, vfs/queue and vfs/queue-set-expiry, used by the GUI, drive-status, buffer-guard, backup-health and detach. A test fails if any source file builds its own ["rc", ...] call. There are no rc calls in scripts or docs.
• Stale socket. rclone does not remove its socket after a crash or kill -9, and the next start then fails with bind: address already in use (checked on 1.75.1). Under KeepAlive the mount would never come back. So prepare() now:
  • removes a socket that nobody answers on;
  • leaves alone a socket that answers, because it belongs to a running rclone. The new start then fails the same way a second mount on the same TCP port used to.
• Path limit. If the socket path is longer than macOS allows (103 bytes), prepare() stops the start with a clear message. Without that check, rclone fails with invalid argument.
• --rc-no-auth stays, on purpose. On a socket nothing gains from a password:
  • vfs/queue-set-expiry, which every detach needs, requires either a password or --rc-no-auth.
  • The only callers that can still reach the socket are processes of the same user. Those can read rclone.conf, token included, directly.
  • A per-start password would be one more way for clients to lose the queue after a restart.
  • The test checks the address instead: the only --rc-addr is the socket, and there is no 127.0.0.1, localhost or :5572 anywhere in the arguments.
• Requirement. The client flag --unix-socket needs rclone ≥ 1.68 (Sept 2024). Every CloudMachine install downloaded a newer one: install-rclone takes the latest, and the project dates from 2026.

Drive trash (--drive-use-trash=true) as a second layer: not enabled.

• Bands are rewritten in place, so uploads would not fill the trash.
• Deletions would. The big deletions are deliberate ones (re-creating the image, clearing an old folder). Each would keep hundreds of GB counted against the account for 30 days. On this account, running out of space stops the mount (storageQuotaExceeded).
• The free-space alarm would also report space that no folder shows, because operations/about counts the trash.
• With the socket in place, the trash would only protect against a process of the same user deleting through the mount. Such a process can just as well run its own rclone purge --drive-use-trash=false.

The reasoning is written up in docs/design.md and in a comment next to the flag.

W1: isConfigured fails closed

• RemoteConfigurer.isConfigured returned false on a timeout, a failed start or exit code 1. An unreadable or broken rclone.conf gives exit 1 (checked).
• It now returns Bool?, matches whole lines (mygdrive: is not gdrive:), and requires succeeded.
• connect stops on nil with a message, even with --replace-existing.
• DriveFolder.decide(legacyEvidence: nil) refuses whenever the answer would decide the name.
• The window keeps its last known answer, instead of offering "Connect Google Drive" on a working installation.

Not done: the audit's extra local evidence for a legacy installation. There is no reliable local trace:

• the cache directory is named gdrive{hash};
• agents-version is written at the first launch of any install.

W3: ProcessRunner lost output

Cause. terminationHandler removed the readabilityHandlers before the last data in the pipe was read. Reads also ran on a separate Foundation queue, so a chunk already read could reach the serial queue after the result had been built.

Fix

• Both pipes are read by DispatchSourceRead on the same serial queue that builds the result.
• After the process exits, a final non-blocking read collects what is left. It stops at EAGAIN, not at EOF, so a --daemon child that keeps the pipe open cannot hold the result.
• The reader keeps draining, and discarding, until EOF. A child that inherited the pipe therefore never blocks on a full pipe.
• The timeout path keeps the same "keep draining" behaviour.

Test. 8 tasks × 500 runs of /bin/cat on a 4.4 kB file must return exactly the file every time. It also checks stderr, and that an inherited pipe (sleep 20 &) does not delay the result.

• On origin/main: 970 of 4000 calls lost their output.
• On this branch: 0, in 5 runs.

TimeMachineStatus.output now returns nil (no answer) when the exit code is non-zero or the output is empty. The exception is "No destinations configured", which still counts as an answer, whatever exit code comes with it. Checked here: tmutil status and tmutil destinationinfo both exit 0 on a working system.

W2: false "no Full Disk Access" alarm

• Watchdog: reads the Time Machine preferences up to 3 times, 5 s apart (BackupHealth.readPreferences).
• Window: shows "missing" only after 2 failed reads in a row (BackupHealth.ReadConfirmation).
  • The first good read restores it at once.
  • At launch the state starts as "missing", so a real lack of permission still shows straight away.
• Missing access makes every read fail, so the real alarm is only delayed by about 10 s.

S1-S5 and LOW

• S1: MachineBudget.limitGB looks the limit up under the folder first, then under the stored machine key (MachineIdentity.storedKey). set-limit moves an old entry instead of duplicating it.
  • On this Mac, after the upgrade, the 3500 GB limit takes effect: the usage measurement (rclone size every 6 h) and the 90%/100% alarms start working.
  • Last measurement: 589 GiB, so no alarm.
• S2: "Back up now" uses canStartBackup: dependencies, remote, mount, attached image, registered TM, !isBusy. An old backup, an unread queue or the daily limit no longer grey it out. This also fixes N5: the menu now respects isBusy.
• S3: MachineBudget.standing: no measurement, or one older than 12 h, shows amber; no limit shows neutral. This also fixes N2, the inconsistent tone between the row and the sidebar.
• S4: an empty queue with erroredFiles > 0 shows "N fragments abandoned - only on this Mac". The queue row takes its tone from uploadTone(uploadState) (N3), and the free-space row uses freeSpaceTone (N2).
• S5: docs/design.md now gives 327-793 GB per day, with the audit's measurement and its caveat about bands smaller than 32 MiB.
• N9: actions/checkout, upload-artifact and action-gh-release are pinned to SHAs, with the version in a comment.

Skipped

• N1 (production on 1.3.4): a deployment state, not code.
• N4 (remembered section, setup steps only on Overview): a UX decision for the owner.
• N6 (contrast of the gradient, Reduce Transparency on the sidebar): a visual change to the chosen mockup; it needs the owner's eye.
• N7 (decimal separator, Date.formatted ignoring CM_LANGUAGE): needs locale plumbing from L10n into every formatter. Not cheap, and not risk-free.
• N8 (rotating rclone.log while rclone runs): logShowsUploadStalled reads the last 30 minutes of that log. A copy-truncate on a running mount could cut exactly those lines and silence the daily-limit detection. It needs its own design.
• N10 (test canary in the production log): a production file, outside the scope of code changes.

What happens on brew upgrade from 1.3.4

1. Homebrew quits the app (uninstall quit:), replaces the bundle and reopens it.
2. AgentRepair.afterLaunch reloads backup-health, gdrive-attach and buffer-guard, so they run the new code.
3. gdrive-buffer is not restarted. This is deliberate and unchanged: restarting it drops the mount under Time Machine. The running rclone (on production, pid 1758) keeps listening on 127.0.0.1:5572 with no password.
4. The new clients find no socket and use the old address (RCTransport.legacyTCP). The queue, the watchdog and detach keep working, exactly as before the upgrade.
5. drive-status shows: Remote control: OPEN on 127.0.0.1:5572 - the mount was started by an older version ... run prepare-shutdown, then restart the Mac.
6. K1 is closed at the mount's next start: a restart of the Mac, or a crash of rclone.
   • launchd starts the same cloudmachine-agent mount-drive from the new bundle. The plist does not change.
   • prepare() creates ~/.cloudmachine/run (0700), and rclone starts on the socket.
   • From then on nothing listens on 5572, and the clients use the socket by themselves.
   • No manual configuration step is needed.
   • To close it straight away: cloudmachine-agent prepare-shutdown, then a restart.

The other fixes take effect as soon as the app and the agents run the new code, after step 2.

Tests

• swift build: OK.
• swift test --skip BackupImageServiceTests: 359 tests, 0 failures, locally. I skipped BackupImageServiceTests because it takes the production image lock on this Mac. CI runs everything.
• swift format lint --strict --recursive Sources Tests: clean with the toolchain's swift-format. CI uses the Homebrew one.
• Each fix reverted in turn, with its tests run (all caught):

Fix reverted	Tests
W1 remoteListed back to false on failure	2 failures
W1 decide with nil treated as false	1
W3 answer(from:) ignoring the exit code	3
W2 a single read attempt	4
W2 panel flipping on one failure	2
S1 folder-only lookup	1
S2 button tied to healthy	2
S3 no measurement = ok	2
S4 "Everything uploaded" with abandoned bands	2
K1 TCP address in the mount arguments	2
K1 stale socket not removed	1
W3 ProcessRunner on origin/main	970/4000 lost outputs

Not run: the app itself, launchd, hdiutil, a real rclone mount on the socket. This Mac runs the production backup, so I did not touch any of them. The socket mechanism was checked on a separate rclone rcd.

🤖 Generated with Claude Code