temp-dirs is the one rule in the shipped database whose patterns still
match anywhere on the disk instead of the directory they name:
{
"id": "temp-dirs",
"patterns": ["/tmp/**", "**/var/tmp/**", "**/appdata/local/temp/**"],
"verdict": "review"
}/tmp/** is anchored, as #41 left it. **/var/tmp/** is not, so it
reaches any directory on the disk that happens to hold a var/tmp —
which is a shape that turns up constantly: Symfony and other PHP projects
keep a var/ beside the code, Homebrew has /opt/homebrew/var, and
anything under /usr/local/var matches too.
Classifying the embedded database confirms it:
/var/tmp/systemd-private/x -> TempFile/Review via temp-dirs (correct)
/home/user/var/tmp/notes.txt -> TempFile/Review via temp-dirs (wrong)
/home/user/project/var/tmp/session.dat -> TempFile/Review via temp-dirs (wrong)
/opt/homebrew/var/tmp/x -> TempFile/Review via temp-dirs (wrong)
/home/user/var/log/notes.txt -> Unknown/Review (correct)
The last two lines are the point: unix-system-logs names both forms of
the real path and stays out of a user's own var/log, and temp-dirs
does not do the same for var/tmp. review is an actionable verdict, so
the app offers to quarantine whatever this reaches.
The fix mirrors unix-system-logs: replace **/var/tmp/** with
/var/tmp/** and /private/var/tmp/**, the second being where macOS
actually keeps it. /private/var/tmp/x classifies correctly today only
because the pattern is loose, so both are needed.
Worth extending rules_do_not_reach_outside_the_paths_they_name in
rules.rs with a var/tmp case, and rules_still_reach_the_paths_they_do_name
with the two real ones — that test pair is where #41 was pinned.
crates/diskern-core/rules/base.json:90
temp-dirsis the one rule in the shipped database whose patterns stillmatch anywhere on the disk instead of the directory they name:
{ "id": "temp-dirs", "patterns": ["/tmp/**", "**/var/tmp/**", "**/appdata/local/temp/**"], "verdict": "review" }/tmp/**is anchored, as #41 left it.**/var/tmp/**is not, so itreaches any directory on the disk that happens to hold a
var/tmp—which is a shape that turns up constantly: Symfony and other PHP projects
keep a
var/beside the code, Homebrew has/opt/homebrew/var, andanything under
/usr/local/varmatches too.Classifying the embedded database confirms it:
The last two lines are the point:
unix-system-logsnames both forms ofthe real path and stays out of a user's own
var/log, andtemp-dirsdoes not do the same for
var/tmp.reviewis an actionable verdict, sothe app offers to quarantine whatever this reaches.
The fix mirrors
unix-system-logs: replace**/var/tmp/**with/var/tmp/**and/private/var/tmp/**, the second being where macOSactually keeps it.
/private/var/tmp/xclassifies correctly today onlybecause the pattern is loose, so both are needed.
Worth extending
rules_do_not_reach_outside_the_paths_they_nameinrules.rswith avar/tmpcase, andrules_still_reach_the_paths_they_do_namewith the two real ones — that test pair is where #41 was pinned.
crates/diskern-core/rules/base.json:90