profile: drop @tmp-shared and the {host_tmpdir} variable (closes #399)

[vyskocilm]

Closes #399.

What

@tmp-shared and the {host_tmpdir} variable behind it are removed. internal/cli/tmpdir.go goes with them.

Maintainer ruling: drop it, YAGNI, can be added back later.

Why the whole surface and not the directory's location

#399 asked whether the allocation should move from /tmp to /run/user/<uid>. Nothing needs the variable at all:

• Only [profile.tmp-shared] named {host_tmpdir}. No other shipped profile, nothing includes it.
• engineforwardedpath.go cited it only as an example of a divergent host:guest bind; @claude's {home}/.local/bin/claude:/snug/bin/claude is the same example and stays.
• Environ.HostTmpDir was a resolver input the CLI filled.

The capability did not go anywhere — /tmp is the one path snug's own mount yields, so a profile that NAMES a host directory still takes it over, and --dry-run renders the path plus the "this is the HOST's /tmp" note. What is gone is snug allocating a per-project 0700 directory under os.TempDir(), checking it for the classic /tmp races, and binding it: machinery whose whole job was to pick a path a profile can name itself.

Also gone with it: 213MB/1209-directory /tmp accumulation #399 measured came from that allocator plus SIGKILL orphans.

The retired variable REFUSES

snug: profile "old": {host_tmpdir} in "{host_tmpdir}:/tmp" was removed with the @tmp-shared profile and has no replacement: name the host directory yourself, rw = ["/path/on/host:/tmp"]
exit=77

A profile still carrying {host_tmpdir} is not a typo — it was a real variable for the life of @tmp-shared — and plain "unknown variable" sends its author to check a spelling that is correct. Precedent: retiredAnonKey in internal/profile/file.go.

TestTheRetiredHostTmpdirVariableNamesItsOwnRemoval (internal/policy) is the named regression, and asserts the general arm beside it: a special case swallowing every unknown name would pass an assertion about {host_tmpdir} alone.

What the red-team finding leaves behind

internal/engine/runsweep.go's name filter (issue #425 F1) matches a name SHAPE rather than the snug-<uid>- prefix, because a target-derived name collides with it. The concrete collision was @tmp-shared's directory — payload-writable, so a sandbox writing /tmp/lock got another project's shared /tmp deleted, measured end to end. Filter and its test STAY: the claim is that the NEXT mechanism of that shape is safe without anyone remembering the file. Test renamed TestSweepNeverTouchesATargetDerivedDirectory, comments rewritten to say the profile is gone and the shape rule is not.

The redteam round found one sink the refusal did not reach

symlink = [{ at = "...", target = "..." }] expanded at and passed target through untouched — one key of a two-key table behaving unlike the other, silently. So {host_tmpdir} rendered verbatim into a link inode there while refusing in ro, rw, tmpfs, optional, symlink.at, every environ verb, identity.ssh_key and through an include. So did {home}: target = "{home}/x" put the six literal characters {home} in the sandbox and nothing said so.

Both keys expand now. Target is NOT Cleaned, unlike at — a link target is resolved by the kernel relative to the link and the shipped ones are relative on purpose (usr/bin). TestASymlinkTargetExpandsVariablesLikeEveryOtherField asserts both halves; negative control run against the old line, which fails it on the {home} arm. No golden moves: no shipped profile writes a variable in a symlink target.

The rest of the round is clean

• Empty host path: unreachable. splitSpec refuses ":/tmp" with "both sides must be absolute paths" before any mount is built, and {host_tmpdir} refuses inside expandVars, so no --bind "" /tmp argv and no nil-deref.
• Sweeps: snug-<uid>-sha256_<64hex> is still refused by isEngineRunDirName's decimal-components rule, so F1's shape is not newly deletable. Measured with five planted decoys and a live @podman-socket run.
• Replacement grant: behaves as an ordinary bind. EvalSymlinks canonicalises the source, --dry-run renders what actually gets bound, FIFO source refused (ro is not read-only for a FIFO: a payload writes out through the default @parent-ro grant #287), nonexistent source refused, rejectHostHomeBind still fires.

What a user no longer gets, stated plainly: prepareHostTmpDir's symlink-at-the-allocated-name refusal, its owner == uid check, and its exactly-0700 requirement. Those were owed because SNUG chose the path; a path the human names gets the ordinary bind-grant contract every other ro/rw grant has always had.

Tests

test/integration/hosttmpvisibility_test.go (issue #87's local half) had a @tmp-shared arm. It now authors a profile binding a directory of its own at /tmp, and each arm carries a host-side control: the marker the payload writes to guest /tmp MUST appear in the named directory for the shared arm and MUST NOT for the private-tmpfs arm. Negative control run: with the profile flag removed the arm fails with "this arm never exercised a bind at /tmp and its decoy check proves nothing".

Three fixtures that skipped @tmp-shared while sweeping every builtin (envuncheckedsink, ownedenv) lose the skip — an exception list is where a sweep rots. jsonrefusal_test.go's "grant missing" class reached its refusal through @tmp-shared's unallocated directory and now uses a profile naming a path that does not exist.

Docs

README profile table, INDEX.md (§7.3 rewritten, path-variable list, tree listing, builtin-name count, host-integration-surfaces intro, the sessions-share-this-surface paragraph), THREAT-MODEL.md (#87's local half now argues from what a /tmp grant binds rather than from the allocator), TARGET-LOCK.md, ENVIRONMENT-VARIABLES.md (sanitise example), PARAMETERISED-PROFILES.md, VERIFY.md §9a-quater (new, both halves with real output).

TestINDEXAdvertisesExactlyThePathVariablesResolveBuilds caught the INDEX path-variable list on its own — issue #224's guard doing its job.

Verification

make gate green. SNUG_REQUIRE_SANDBOX=1 SNUG_SANDBOX_TIMEOUT=25m make integration on this host, both suites green: 210 PASS + 3 PASS, 2 SKIP, engine tests: 46 ran, floor 46 — podman version 6.0.2, exit 0. (25m ceiling because the default 8m does not fit this host; predates this branch.)

Redteam round run against this branch before push, per the definition of done. One finding, fixed here; the round's own summary is quoted above.

🤖 Generated with Claude Code