samagotchi 0.128.0 → 0.129.0

data/lib/samagotchi/guardrails/pair_command.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
-require "tmpdir"
+require_relative "outside"
+require_relative "read_only_shell"
 require_relative "review_paths"
 require_relative "shell_paths"
 require_relative "shell_lex"
@@ -17,10 +18,15 @@ module Samagotchi
     #   a command of its own, one it hands another interpreter (ruby -e,
     #   python <<EOF) by its text. A command it can't read is refused
     #   (UNREADABLE), never let through on a text match;
-    # - #outside_writes?: whether it writes outside the project (a
-    #   redirection's target, tee's files, cp/mv/ln/install/rsync/ditto's
-    #   destination), the tmp dirs and /dev/null aside; a target it can't
-    #   resolve counts as outside.
+    # - #outside_writes?: whether it may change something outside the
+    #   project, failing closed: no unless it only reads
+    #   (ReadOnlyShell.read_only?), or only reads but for writes into the
+    #   project or a tmp dir (ReadOnlyShell.read_only_but_writes?), or
+    #   stays inside the project (#stays_inside?: it runs in the project and
+    #   every path it names, an option's value, a glob's fixed part and the
+    #   paths in a script it hands on among them, lands in the project or a
+    #   tmp dir, Outside.inside? / Outside.tmp_write?). A word it can't
+    #   resolve ($var, $(…), a dir after cd $X) counts as outside.
     # A data heredoc (cat, tee, git commit -F - read it: ShellLex::HEREDOC)
     # is not looked into: it's text being written, not run.
     class PairCommand
@@ -37,45 +43,119 @@ module Samagotchi
       INTERPRETERS = %w[python python3 python2 ruby irb node deno bun perl php lua osascript jshell].freeze
       # Options whose next word is code or a command, for any program.
       CODE_OPTIONS = %w[-c -e -exec --exec -execdir --command --eval -x].freeze
-      # Programs that detach what they start.
-      DETACHERS = %w[nohup setsid disown daemonize].freeze
+      # Programs that detach what they start, or run it later (cron, at).
+      DETACHERS = %w[nohup setsid disown daemonize crontab at batch].freeze
       # Programs that print the environment or a keychain's secrets, whatever
       # their arguments.
-      ENV_READERS = %w[printenv security].freeze
+      ENV_READERS = %w[printenv security op].freeze
+      # Commands that print a stored credential (a token, a password, a
+      # key), by the program and the words that say so in its arguments.
+      CREDENTIAL_PRINTERS = {
+        "gh" => [%w[auth token]],
+        "git" => [%w[credential], %w[credential-osxkeychain], %w[credential-store], %w[credential-cache],
+                  %w[credential-manager]],
+        "gcloud" => [%w[print-access-token], %w[print-identity-token]],
+        "aws" => [%w[configure get], %w[configure export-credentials], %w[ecr get-login-password],
+                  %w[sts get-session-token]],
+        "az" => [%w[account get-access-token]],
+        "heroku" => [%w[auth:token]],
+        "npm" => [%w[token]],
+        "kubectl" => [%w[config view --raw]],
+        "keyring" => [%w[get]]
+      }.freeze
+      # A credential helper run by itself (docker-credential-osxkeychain get).
+      CREDENTIAL_HELPER = /\A(?:docker-credential-|git-credential-)/
       ENV_TEXT = %r{/proc/[^\s]*/environ}
+      # This machine's loopback names (.web_text): localhost and its
+      # subdomains, 127.x.y.z, 0.0.0.0, ::1 spelt any way, ::ffff:127.x.
+      LOOPBACK_HOSTS = [/(?:[\w-]+\.)*localhost\.?/, /127(?:\.\d{1,3}){1,3}/, /0\.0\.0\.0/,
+                        /\[?(?:0{0,4}:){2,7}0{0,3}1\]?/, /\[?::ffff:127(?:\.\d{1,3}){3}\]?/].freeze
       # An interpreter's script that reads the environment or detaches.
       SCRIPT_ENV_TEXT = /\bos\.environ\b|\bgetenv\b|\bprocess\.env\b|\bENV\b|\bprintenv\b|%ENV\b/
       SCRIPT_BACKGROUND_TEXT = /\b(?:nohup|setsid|disown|daemonize|Process\.daemon|detach(?:ed)?)\b/
       # Programs that read a folder's whole tree: given home (or any folder
       # above a denied one) they reach the secrets in it.
-      SWEEPERS = %w[find tar cp rsync scp zip 7z cpio grep egrep fgrep rg ag ack fd ditto].freeze
+      # A link to such a folder reaches them too (ln, link).
+      SWEEPERS = %w[find tar cp rsync scp zip 7z cpio grep egrep fgrep rg ag ack fd ditto ln link].freeze
+      # Programs that make a link (and cp's options that do).
+      LINKERS = %w[ln link mklink].freeze
+      CP_LINK_OPTION = /\A-[a-zA-Z]*[sl]|\A--(?:symbolic-)?link\z/
+      # An interpreter's script that makes a link.
+      SCRIPT_LINK_TEXT = /symlink|\blink\(|\bln\s|\bmklink\b|FileUtils\.ln|hardlink/i
       # git settings that make git run a command (or show one), and git
       # config's scopes beyond the repository.
       GIT_RUNNING_KEYS = %w[core.fsmonitor core.sshcommand core.hookspath core.pager core.editor].freeze
       GIT_WIDE_SCOPES = %w[--global --system].freeze
       GIT_VALUE_OPTIONS = %w[-C --git-dir --work-tree --namespace --exec-path].freeze
-      # Writers whose last argument (or -t DIR) is the destination.
-      COPIERS = %w[cp mv ln install rsync ditto].freeze
-      REDIRECTS = %w[> >> &> &>> 1> 1>> 2> 2>>].freeze
-      REDIRECT_WORD = /\A\d*(?:&>>?|>>?)(?!&)(.+)\z/
-      DEVICES = %w[/dev/null /dev/stdout /dev/stderr /dev/tty].freeze
+      # Devices a command may name in the project's stead.
+      DEVICES = %w[/dev/null /dev/stdout /dev/stderr /dev/tty /dev/zero /dev/random /dev/urandom].freeze
+      # A path in a script's text (an interpreter's -e/-c, a heredoc): ~, ..
+      # or an absolute path, at the text's start or after a space, quote,
+      # bracket, = or comma.
+      SCRIPT_PATH = %r{(?:\A|(?<=[\s'"(\[=,]))(?:~|\.\.|/[\w.~-])[^\s'"`;,()\]]*}
+      # A $(…) that is only a message's heredoc (git commit -m "$(cat <<EOF …)"),
+      # its body cut by ShellLex.code_text.
+      MESSAGE_SUBST = /\$\(cat <<-?(['"]?)(\w+)\1\n\2\n\)/
+      # Assignments whose value is a search list, not a path.
+      LIST_VARIABLES = %w[PATH].freeze
       GLOB = /[*?\[\]{}]/
+      SHELL_BRACKETS = %w[[ [[ ]] { } ]].freeze
       # How many matches of a glob are checked against the denylist.
       GLOB_LIMIT = 500
       # How deep scripts handed to a shell are read; deeper is UNREADABLE.
       MAX_DEPTH = 3
 
-      # The tmp dirs a pair turn writes into freely (neither asked nor
-      # denied): Dir.tmpdir, $TMPDIR, /tmp, /private/tmp.
-      def self.tmp_roots
-        [Dir.tmpdir, ENV.fetch("TMPDIR", nil), "/tmp", "/private/tmp"].compact.reject(&:empty?)
-                                                                      .map { |dir| ProtectedPaths.real(dir) }.uniq
+      # Whether a pair turn may write +path+ (absolute) without asking: it
+      # lands in the project (Outside.inside?) or in a tmp dir the project
+      # isn't in (Outside.tmp_write?), every way it resolves. No project
+      # (+root+ blank): the tmp dirs only.
+      def self.writable?(path, root:, cwd: nil)
+        root = root.to_s
+        return Outside.tmp_write?(path, root: cwd || Dir.pwd) if root.empty?
+
+        Outside.inside?(path, root: root) || Outside.tmp_write?(path, root: root)
+      end
+
+      # Whether +path+ is in a .git/hooks folder, as given or as it resolves
+      # (ShellPaths::HOOKS_PART): git runs what is there.
+      def self.git_hook?(path)
+        path.to_s.match?(ShellPaths::HOOKS_PART) ||
+          (path.to_s.start_with?("/") && ProtectedPaths.reals(path).any? { |real| real.match?(ShellPaths::HOOKS_PART) })
+      end
+
+      # A command's text naming chi web's endpoint on this machine: a
+      # loopback name (LOOPBACK_HOSTS) or one of +hostnames+, and one of
+      # +ports+, anywhere in it (a URL's host:port, nc's host port, a
+      # script's ("host", port), /dev/tcp/host/port, curl's --resolve); or
+      # 0:port. nil without a port.
+      # @return [Regexp, nil]
+      def self.web_text(ports, hostnames: [])
+        return nil if ports.empty?
+
+        hosts = (LOOPBACK_HOSTS.map(&:source) + hostnames.map { |name| Regexp.escape(name) }).join("|")
+        port = ports.map { |number| Regexp.escape(number.to_s) }.join("|")
+        Regexp.new("\\A(?=[\\s\\S]*?(?<![\\w.-])(?:#{hosts})(?![\\w-]))(?=[\\s\\S]*?(?<![\\w.])(?:#{port})(?!\\d))|" \
+                   "(?<![\\w.:-])0:(?:#{port})(?!\\d)", Regexp::IGNORECASE)
+      end
+
+      # This machine's own names (Socket.gethostname, with and without
+      # its domain and with .local), lowercased.
+      def self.hostnames
+        require "socket"
+        name = Socket.gethostname.to_s.downcase
+        short = name.split(".").first.to_s
+        [name, short, "#{short}.local"].reject { |host| host.empty? || host == ".local" }.uniq
+      rescue StandardError
+        []
       end
 
       # @param paths [ReviewPaths] the denylist
-      # @param root [String, nil] the project root (outside writes)
-      def initialize(text, cwd:, paths:, home:, root: nil, depth: 0, tmp_roots: nil)
-        @tmp_roots = tmp_roots
+      # @param root [String, nil] the project root (outside writes; none:
+      #   every command but a read-only one writes outside)
+      # @param web [Regexp, nil] chi web's endpoint in a command's text
+      #   (.web_text)
+      def initialize(text, cwd:, paths:, home:, root: nil, depth: 0, web: nil)
+        @web = web
         @text = text.to_s
         @cwd = cwd
         @paths = paths
@@ -93,10 +173,28 @@ module Samagotchi
         @refusal = PairBoundary::UNREADABLE
       end
 
-      # Whether it writes outside the project (asked about, never denied).
+      # Whether it makes a link (ln, link, cp -s/-l, a script's symlink): a
+      # path through a link it makes now is judged before the link exists,
+      # so the owner approves it (asked about; a link to a folder above a
+      # secret is refused: SWEEPERS). True for one it can't read.
+      def links?
+        return @links if defined?(@links)
+
+        @links = @depth > MAX_DEPTH || ShellLex.simple_commands(ShellLex.lex(@text)).any? do |words|
+          words.is_a?(Array) && link_command?(words)
+        end
+      rescue StandardError
+        @links = true
+      end
+
+      # Whether it may write outside the project (asked about, never
+      # denied); true for one it can't read.
       def outside_writes?
-        refusal
-        @targets.to_a.any? { |path| outside?(path) }
+        return @outside_writes if defined?(@outside_writes)
+
+        @outside_writes = !(ReadOnlyShell.read_only?(@text) || writes_inside? || stays_inside?)
+      rescue StandardError
+        @outside_writes = true
       end
 
       private
@@ -110,14 +208,14 @@ module Samagotchi
         return PairBoundary::CHI if subst && code.match?(CHI_TEXT)
         return PairBoundary::BACKGROUND if tokens.any? { |type, value| type == :op && value == "&" }
         return PairBoundary::ENVIRONMENT if code.match?(ENV_TEXT)
+        return PairBoundary::CHI_WEB if @web && code.match?(@web)
         return PairBoundary::SECRET if subst && code.match?(PairBoundary::SECRET_TEXT)
 
-        @targets = []
+        @read_only = ReadOnlyShell.read_only?(@text)
         walk = ShellPaths::Walk.new(@cwd, @home, ENV)
         ShellLex.simple_commands(tokens).each do |words|
           next walk.step(words) if words.is_a?(Symbol)
 
-          @targets.concat(write_targets(words, walk))
           reason = words_refusal(words) || scripts_refusal(words) || paths_refusal(words, walk.step(words))
           return reason if reason
         end
@@ -127,10 +225,12 @@ module Samagotchi
       # A simple command's own refusal, by its program and arguments.
       def words_refusal(words)
         at = program_at(words)
+        return PairBoundary::CHI if chi_in_values?(words)
+        return PairBoundary::VERB if at && unplain_program?(words[at])
+
         program = at && File.basename(words[at])
         args = at ? words[(at + 1)..] : []
         return PairBoundary::CHI if program == "chi" && !CHI_ALLOWED.include?(args)
-        return PairBoundary::CHI if chi_in_values?(words)
 
         upto = at ? words[0..at] : words
         return PairBoundary::BACKGROUND if upto.any? { |w| DETACHERS.include?(File.basename(w)) } || detached_session?(program, args)
@@ -140,6 +240,14 @@ module Samagotchi
         nil
       end
 
+      # A program word the shell expands: a $var, a $(…), a glob (bin/ch?,
+      # ${e}i); the test brackets and braces are words of their own.
+      def unplain_program?(word)
+        return false if SHELL_BRACKETS.include?(word)
+
+        word.include?("$") || word.include?(ShellLex::SUBST) || word.match?(GLOB)
+      end
+
       # chi in an assignment's value (FOO=chi, alias x='chi …') or in the
       # word after an option that takes code or a command (-exec, -c, -e).
       def chi_in_values?(words)
@@ -158,8 +266,7 @@ module Samagotchi
         program = File.basename(words[at])
         scripts(words, at).each do |script|
           reason = if SHELLS.include?(program) || program == "eval"
-                     PairCommand.new(script, cwd: @cwd, paths: @paths, home: @home, root: @root, depth: @depth + 1,
-                                             tmp_roots: @tmp_roots).refusal
+                     nested(script).refusal
                    elsif INTERPRETERS.include?(program)
                      script_text_refusal(script)
                    end
@@ -218,21 +325,32 @@ module Samagotchi
           (program == "tmux" && args.any? { |arg| arg.match?(/\Anew(-session)?\z/) } && args.include?("-d"))
       end
 
-      # printenv, security; set, export, declare and typeset that list
-      # (no assignment); launchctl getenv/export; ps with a BSD e (ps e, eww).
+      # printenv, security, op, a credential printer (CREDENTIAL_PRINTERS)
+      # or helper; set, export, declare and typeset that list (no
+      # assignment); launchctl getenv/export; ps with a BSD e (ps e, eww) or
+      # -E (ps -E, -axE).
       def env_reader?(program, args)
-        return true if ENV_READERS.include?(program)
+        return true if ENV_READERS.include?(program) || program.to_s.match?(CREDENTIAL_HELPER)
+        return true if credential_printer?(program, args)
 
         listing = args.none? { |arg| !arg.start_with?("-", "+") }
         case program
         when "set" then args.empty?
         when "export", "declare", "typeset" then listing
         when "launchctl" then %w[getenv export].include?(args.first)
-        when "ps" then args.any? { |arg| arg.match?(/\A[a-zA-Z]*e[a-zA-Z]*\z/) }
+        when "ps" then args.any? { |arg| arg.match?(/\A[a-zA-Z]*e[a-zA-Z]*\z|\A-[a-zA-Z]*E[a-zA-Z]*\z/) }
         else false
         end
       end
 
+      # Whether +args+ hold one of +program+'s CREDENTIAL_PRINTERS words, in
+      # order and next to each other (git -C x credential fill).
+      def credential_printer?(program, args)
+        CREDENTIAL_PRINTERS.fetch(program, []).any? do |words|
+          args.each_cons(words.size).any?(words)
+        end
+      end
+
       # env with no command after it prints the environment.
       def bare_env?(words)
         assignment = ->(word) { word.start_with?("-") || word.match?(/\A[A-Za-z_]\w*=/) }
@@ -279,6 +397,8 @@ module Samagotchi
       def paths_refusal(words, resolved)
         program_word = (at = program_at(words)) && File.basename(words[at])
         resolved.each do |word, path|
+          return PairBoundary::GIT_HOOKS if !@read_only && PairCommand.git_hook?(path || word)
+
           if path
             return PairBoundary::SECRET if @paths.secret_refusal([path])
             return PairBoundary::HOME_SWEEP if SWEEPERS.include?(program_word) && above_denied?(path)
@@ -318,48 +438,123 @@ module Samagotchi
 
       # Whether +path+ is a denied root's folder or one above it.
       def above_denied?(path)
-        real = ProtectedPaths.real(path)
-        @paths.denied_roots.any? { |root| ShellPaths.within?(root, real) }
+        ProtectedPaths.reals(path).any? { |real| @paths.denied_roots.any? { |root| ShellPaths.within?(root, real) } }
       end
 
-      # The paths a simple command writes (nil for one it can't resolve), from
-      # the dir it runs in (before a cd in it takes effect).
-      def write_targets(words, walk)
-        targets = []
-        words.each_with_index do |word, i|
-          if REDIRECTS.include?(word) && words[i + 1]
-            targets << walk.path(words[i + 1])
-          elsif (target = word[REDIRECT_WORD, 1]) && !word.start_with?("<")
-            targets << walk.path(target)
-          end
+      def link_command?(words)
+        at = program_at(words)
+        program = at && File.basename(words[at])
+        return true if LINKERS.include?(program)
+        return true if program == "cp" && words[(at + 1)..].any? { |arg| arg.match?(CP_LINK_OPTION) }
+        return true if words.each_cons(2).any? { |option, word| CODE_OPTIONS.include?(option) && LINKERS.include?(File.basename(word)) }
+
+        runner = (0..(at || (words.size - 1))).find { |i| runner?(words[i]) } or return false
+        name = File.basename(words[runner])
+        scripts(words, runner).any? do |script|
+          SHELLS.include?(name) || name == "eval" ? nested(script).links? : script.match?(SCRIPT_LINK_TEXT)
         end
-        at = program_at(words) or return targets
-        program = File.basename(words[at])
-        args = words[(at + 1)..].reject { |w| REDIRECTS.include?(w) || w.match?(REDIRECT_WORD) }
-        plain = args.reject { |arg| arg.start_with?("-") }
-        if program == "tee"
-          targets.concat(plain.map { |arg| walk.path(arg) })
-        elsif COPIERS.include?(program)
-          dir = args[args.index("-t") + 1] if args.include?("-t")
-          dir ||= args.find { |arg| arg.start_with?("--target-directory=") }&.split("=", 2)&.last
-          dir ||= plain.last if plain.size >= 2
-          targets << walk.path(dir) if dir
+      end
+
+      def nested(script) = PairCommand.new(script, cwd: @cwd, paths: @paths, home: @home, root: @root,
+                                                   depth: @depth + 1, web: @web)
+
+      # Whether it only reads but for writes (a > or >> target, cp's
+      # destination, tee's files) into the project or a tmp dir.
+      def writes_inside?
+        ReadOnlyShell.read_only_but_writes?(@text, cwd: @cwd, home: @home, env: ENV) { |path| writable?(path) }
+      end
+
+      # Whether it stays inside the project: every simple command runs in
+      # it, and every path it names lands in it or a tmp dir, a script it
+      # hands on included (a shell's read as a command, another
+      # interpreter's paths by its text). The program's own word is not a
+      # path it writes; a word it can't resolve ($var, a $(…) other than a
+      # message's heredoc, a dir it can't tell) is outside. A script file's
+      # body (ruby x.rb, make) is not read.
+      def stays_inside?
+        return false if @root.empty? || @depth > MAX_DEPTH
+
+        tokens = ShellLex.lex(@text)
+        return false if tokens.any? { |_, value| value.include?(ShellLex::SUBST) } && !substs_messages_only?
+
+        walk = ShellPaths::Walk.new(@cwd, @home, ENV)
+        ShellLex.simple_commands(tokens).all? do |words|
+          next walk.step(words) if words.is_a?(Symbol)
+
+          walk.dirs.all? { |dir| dir && writable?(dir) } && words_inside?(words, walk) &&
+            scripts_inside?(words).tap { walk.step(words) }
         end
-        targets
       end
 
-      def outside?(path)
-        return true if path.nil?
-        return false if DEVICES.include?(path)
+      # Whether every $(…) is a message's heredoc (its body cut as data).
+      def substs_messages_only?
+        rest = ShellLex.code_text(@text, keep_written: false).gsub(MESSAGE_SUBST, "")
+        !rest.include?("$(") && !rest.include?("`")
+      end
+
+      # Whether each word of a simple command but the program (and the
+      # wrappers before it) lands in the project or a tmp dir.
+      def words_inside?(words, walk)
+        at = program_at(words)
+        # xargs runs its program on paths it reads from its input
+        return false if at && words[0...at].any? { |word| File.basename(word) == "xargs" }
+
+        words.each_with_index.all? do |word, i|
+          next true if at && (i == at || (i < at && WRAPPERS.include?(File.basename(word))))
+          next true if LIST_VARIABLES.any? { |name| word.start_with?("#{name}=") }
+
+          word_inside?(walk, word)
+        end
+      end
 
-        real = ProtectedPaths.real(path)
-        return false if tmp_roots.any? { |tmp| ShellPaths.within?(real, tmp) }
-        return true if @root.empty?
+      def word_inside?(walk, word)
+        return true if data?(word)
+        return substs_messages_only? if word.include?(ShellLex::SUBST)
 
-        !ShellPaths.within?(real, ProtectedPaths.real(@root))
+        candidate = walk.candidate(word) or return true
+        return text_inside?(walk, candidate) if candidate.match?(ShellPaths::SCRIPT)
+        return glob_inside?(walk, candidate) if candidate.match?(GLOB) && !candidate.include?("$")
+
+        paths = walk.paths(candidate)
+        !paths.empty? && paths.all? { |path| DEVICES.include?(path) || writable?(path) }
+      end
+
+      # A word with spaces or quotes is text (a message, a pattern) unless
+      # it starts like a path.
+      def text_inside?(walk, text)
+        return true unless text.match?(%r{\A(?:~|\.\.|/)})
+
+        expanded = text.sub(%r{\A~(?=/|\z)}, @home)
+        return false if expanded.start_with?("~")
+
+        walk.dirs.all? { |dir| (dir || expanded.start_with?("/")) && writable?(File.expand_path(expanded, dir || "/")) }
+      end
+
+      # A glob by its fixed part (the text before its first glob character).
+      def glob_inside?(walk, word)
+        fixed = word[/\A[^*?\[\]{}]*/]
+        return walk.dirs.all? { |dir| dir && writable?(dir) } if fixed.empty?
+
+        paths = walk.paths(fixed)
+        !paths.empty? && paths.all? { |path| writable?(path) }
+      end
+
+      # The scripts a simple command hands on (#scripts): a shell's as a
+      # command of its own, another interpreter's by the paths in its text.
+      def scripts_inside?(words)
+        limit = program_at(words) || (words.size - 1)
+        at = (0..limit).find { |i| runner?(words[i]) } or return true
+        program = File.basename(words[at])
+        scripts(words, at).all? do |script|
+          if SHELLS.include?(program) || program == "eval"
+            !nested(script).outside_writes?
+          else
+            script.scan(SCRIPT_PATH).all? { |path| writable?(File.expand_path(path.sub(%r{\A~(?=/|\z)}, @home), @cwd || Dir.pwd)) }
+          end
+        end
       end
 
-      def tmp_roots = @tmp_roots ||= PairCommand.tmp_roots
+      def writable?(path) = PairCommand.writable?(path, root: @root, cwd: @cwd)
     end
   end
 end

data/lib/samagotchi/guardrails/parent_approvals.rb

@@ -80,7 +80,8 @@ module Samagotchi
 
         dirs = chi_dirs
         paths = Array(fetch(facts, :paths)).map(&:to_s).reject(&:empty?)
-        return true if paths.any? { |path| dirs.any? { |dir| ProtectedPaths.within?(ProtectedPaths.real(path), dir) } }
+        reals = paths.flat_map { |path| ProtectedPaths.reals(path) }
+        return true if reals.any? { |real| dirs.any? { |dir| ProtectedPaths.within?(real, dir) } }
 
         command = fetch(facts, :command).to_s
         return false if command.empty?

data/lib/samagotchi/guardrails/protected_paths.rb

@@ -4,7 +4,9 @@ module Samagotchi
   module Guardrails
     # Core checks on what the file tools (write, edit, memory_write) touch,
     # after the hooks and before the rules. Paths are compared with
-    # symlinks resolved (on the longest existing parent).
+    # symlinks resolved (on the longest existing parent, `..` taken
+    # physically, a dangling symlink followed: .reals, the lexical answer
+    # and where the write lands, a vote when either is protected).
     #   deny: the approval store's dir, installed bundles (.bundles/:
     #         hooks, rules, manifests) and attached context (a source's
     #         command runs later, outside the gate; chi context writes
@@ -41,7 +43,7 @@ module Samagotchi
         targets = verdict.targets
         return verdict unless targets && FILE_TOOLS.include?(targets.tool)
 
-        paths = targets.paths.map { |p| self.class.real(p) }
+        paths = targets.paths.flat_map { |p| self.class.reals(p) }
         @deny.each do |rule, root, reason|
           next unless paths.any? { |p| self.class.within?(p, root) }
 
@@ -55,8 +57,71 @@ module Samagotchi
         verdict
       end
 
-      # +path+ with symlinks resolved on its longest existing parent.
+      # +path+ as an absolute path the way the kernel opens it: ~ expanded,
+      # relative to +base+, and each `..` taken from where the dir before it
+      # really is (a `..` after a symlinked dir climbs out of its target,
+      # not back to the link's parent as File.expand_path has it). It
+      # differs from File.expand_path only for such a climb; the parts
+      # after the last `..` are kept as given (symlinks not resolved).
+      # A shell's cd may land at either (ShellPaths::Walk keeps both); a file
+      # argument and a tool's path go through this.
+      # @param path [String]
+      # @param base [String, nil] for a relative path (Dir.pwd when nil)
+      def self.expand(path, base = nil)
+        path = path.to_s
+        head, sep, tail = path.partition("/")
+        path = "#{File.expand_path(head)}#{sep}#{tail}" if head.start_with?("~")
+        path = File.join(File.expand_path(base || Dir.pwd), path) unless path.start_with?("/")
+        parts = []
+        path.split("/").each do |part|
+          next if part.empty? || part == "."
+
+          part == ".." ? parts = climb(parts) : parts << part
+        end
+        "/#{parts.join("/")}"
+      end
+
+      # The parts of +parts+'s parent dir: the lexical one unless the dir
+      # is (or goes through) a symlink whose target's parent is elsewhere.
+      def self.climb(parts)
+        lexical = parts[0...-1]
+        dir = "/#{parts.join("/")}"
+        return lexical unless parts.any? && File.directory?(dir)
+
+        physical = File.dirname(File.realpath(dir))
+        return lexical if File.realpath("/#{lexical.join("/")}") == physical
+
+        physical.split("/").reject(&:empty?)
+      rescue SystemCallError
+        lexical
+      end
+      private_class_method :climb
+
+      # How many symlinks .real follows on a path that doesn't exist
+      # (about the kernel's own ELOOP limit).
+      MAX_LINKS = 40
+
+      # +path+ (.expand) with symlinks resolved on its longest existing
+      # parent: where the kernel lands for it. A part that is a dangling
+      # symlink is followed to its target (a write there creates the
+      # target), up to MAX_LINKS times; the missing tail is kept as given.
       def self.real(path)
+        path = expand(path)
+        MAX_LINKS.times do
+          resolved = existing_prefix_real(path)
+          return resolved unless resolved.is_a?(Array)
+
+          path = resolved.first
+        end
+        path
+      rescue SystemCallError
+        path
+      end
+
+      # The old, lexical answer: File.expand_path (lexical `..`), then
+      # realpath of the longest existing prefix, stopping at a dangling
+      # symlink. .reals keeps it beside .real.
+      def self.lexical_real(path)
         path = File.expand_path(path)
         rest = []
         current = path
@@ -69,11 +134,39 @@ module Samagotchi
         path
       end
 
+      # Every place +path+ may be judged as: .lexical_real (what these
+      # checks always looked at) and .real (where the kernel lands), one
+      # entry when they agree. A check that holds for any of them (a
+      # protected dir, a secret) or refuses unless all of them are inside
+      # (the project, tmp) refuses at least what it did with the lexical
+      # answer alone.
+      # @return [Array<String>]
+      def self.reals(path) = [lexical_real(path), real(path)].uniq
+
+      # realpath of +path+'s longest existing prefix with the rest
+      # appended (a String), or [the path with the first dangling symlink
+      # on the way replaced by its target] to resolve again.
+      def self.existing_prefix_real(path)
+        rest = []
+        current = path
+        until File.exist?(current) || current == File.dirname(current)
+          if File.symlink?(current)
+            target = expand(File.readlink(current), File.dirname(current))
+            return [expand(File.join(target, *rest))]
+          end
+          rest.unshift(File.basename(current))
+          current = File.dirname(current)
+        end
+        File.join(File.realpath(current), *rest)
+      end
+      private_class_method :existing_prefix_real
+
+      # Whether +path+ (resolved) is +root+ or in it, +root+ resolved
+      # either way (.reals).
       def self.within?(path, root)
         return false if root.nil? || root.to_s.empty?
 
-        root = real(root.to_s.chomp("/"))
-        path == root || path.start_with?(File.join(root, ""))
+        reals(root.to_s.chomp("/")).any? { |dir| path == dir || path.start_with?(File.join(dir, "")) }
       end
     end
   end