[phucvinh57]

Summary

Security fix. With debug on, the root-run helper created the log file in a user-writable dir and then chown()ed it to the user. chown() follows symlinks, so a symlink placed in that dir could make root change ownership of a file outside it. Debug face images had the same problem, and dirs were created 0777. File writes into user dirs now run with the user's filesystem identity, so the kernel checks them with the user's permissions. Part of the stacked audit PRs starting at #193 (audit).

Closes: N/A / Discussion: N/A

Changes

• auth/core: new ScopedFsUser (per-thread setfsuid/setfsgid). While held, the kernel drops root's file capabilities, so every path component is checked as the user and new files are owned by the user.
• auth/core: setupConfig runs under it; fixOwnership removed; data dirs created 0700; unknown users are refused instead of falling back to $HOME or /.
• auth/pam (helper): log sink opened under ScopedFsUser. Before auth the helper drops root's supplementary groups; if that fails it exits 1 (PAM_AUTH_ERR, fail closed).
• auth/face: saveFailedFace writes debug images under ScopedFsUser.
• auth/test: new fs_user test plants symlinks and checks writes are denied. Needs root: ctest skips it as non-root; CI runs it with sudo.

Verification

$ make build-auth
build OK
$ clang-format --dry-run --Werror <changed auth files>
OK
$ unshare --map-root-user --map-auto auth/build/test/fs_user/fs_user_test
16 checks PASS, including:
[PASS] write through symlink is denied
[PASS] victim content unchanged
[PASS] create inside symlinked root dir is denied
ALL PASS

Manual testing:

Distro / version	Package (.deb/.rpm/AUR/source)	DE / display manager	Hardware (camera, IR, fingerprint)	Flow tested (login, sudo, polkit, lock screen, app)	Result

Not tested: real PAM login/sudo in a VM.

Review report

AI review: 0 important, 1 nit, 2 pre-existing. Nit (comment placement) fixed. Security review ran: no hole found in the fix (kernel cap drop, per-thread creds, spdlog fd lifetime, setgroups fail-closed checked). Pre-existing follow-ups (root still opens user config/faces/db/model files for reading; early readConfig warnings go to stdout) are handled in a later PR of this stack.

Risk

• Low: docs, UI copy, styling, tests
• Medium: app logic, Rust/Tauri commands, face/fingerprint pipeline
• High: PAM module or helper, install/remove scripts, PAM config, packaging, CI/release workflows

What could break, and for whom: users of the PAM helper. A failing setgroups now fails auth closed. Upgrade note: a debugs/ dir left root-owned by very old releases makes debug image saving stop (debug feature only; login unaffected).

How to revert

git revert is enough (reintroduces the bug).

Checklist

• I read the whole diff and can explain every change.
• Verification above shows real output, not a claim.
• All Important review findings are fixed or answered.
• Docs are updated if behavior, install, packaging, or distro support changed.