{"record":{"id":"6610ab60bf9249c7","repo":"astrid-runtime/astrid","slug":"legacy-audit-tree-contains-a-special-file-child","errorCode":null,"errorMessage":"legacy audit tree contains a special file: {child}","messagePattern":"legacy audit tree contains a special file: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-kernel/src/lib.rs","lineNumber":4360,"sourceCode":"        let child_metadata = std::fs::symlink_metadata(&child)?;\n        if child_metadata.file_type().is_symlink()\n            || audit_tree_device(&child_metadata) != root_device\n            || audit_mountpoint(&child)?\n        {\n            return Err(std::io::Error::new(\n                std::io::ErrorKind::InvalidData,\n                format!(\n                    \"legacy audit tree contains a redirect or boundary: {}\",\n                    child.display()\n                ),\n            ));\n        }\n        if child_metadata.is_dir() {\n            validate_audit_tree(&child, root_device)?;\n        } else if child_metadata.is_file() {\n            astrid_core::platform_fs::verify_no_redirects(&child)?;\n        } else {\n            return Err(std::io::Error::new(\n                std::io::ErrorKind::InvalidData,\n                format!(\n                    \"legacy audit tree contains a special file: {}\",\n                    child.display()\n                ),\n            ));\n        }\n    }\n    Ok(())\n}\n\n#[cfg(unix)]\nfn delete_audit_tree(path: &Path, root_device: u64) -> std::io::Result<()> {\n    validate_audit_tree(path, root_device)?;\n    for entry in std::fs::read_dir(path)? {\n        let child = entry?.path();\n        let metadata = std::fs::symlink_metadata(&child)?;\n        if metadata.is_dir() {","sourceCodeStart":4342,"sourceCodeEnd":4378,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-kernel/src/lib.rs#L4342-L4378","documentation":"Thrown during audit-tree validation when a child entry is neither a regular file nor a directory — e.g. a device node, FIFO, or socket. The tree may only contain plain files (which are additionally checked by verify_no_redirects) and directories, so special files are rejected as InvalidData with the offending path.","triggerScenarios":"Running the audit-tree validation when a child path under the tree is a character/block device, named pipe, unix socket, or any other non-regular, non-directory file type.","commonSituations":"Someone placed a unix socket (e.g. a daemon socket) inside the audit directory; a device node was bind-mounted or mknod'ed into the tree; copy tools accidentally recreated FIFOs.","solutions":["Find the special file reported in the error and move it out of the audit tree","Recreate the entry as a regular file or directory if it should hold audit data","If a socket must live there, reconfigure the daemon to place it outside the audit tree","Audit the directory with `find <tree> ! -type f ! -type d` to catch all offending entries"],"exampleFix":"// before: daemon socket inside audit tree\n/var/lib/app/audit/daemon.sock\n// after: move socket elsewhere\n/var/run/app/daemon.sock","handlingStrategy":"validation","validationCode":"for entry in std::fs::read_dir(audit_root)? {\n    let md = entry?.metadata()?;\n    if !md.is_dir() && !md.is_file() {\n        eprintln!(\"special file in audit tree\");\n    }\n}","typeGuard":"fn is_file_or_dir(md: &std::fs::Metadata) -> bool { md.is_dir() || md.is_file() }","tryCatchPattern":"if let Err(e) = validate_audit_tree(root, dev) {\n    if e.kind() == std::io::ErrorKind::InvalidData { eprintln!(\"audit tree invalid: {e}\"); }\n}","preventionTips":["Point daemon sockets and FIFOs outside the audit directory","Run `find <tree> ! -type f ! -type d` in periodic checks","Do not bind-mount device nodes into the audit tree"],"tags":["filesystem","special-file","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}