{"record":{"id":"c2c370284e7291a8","repo":"astrid-runtime/astrid","slug":"legacy-audit-tree-contains-a-redirect-or-boundary-c2c370","errorCode":null,"errorMessage":"legacy audit tree contains a redirect or boundary: {child}","messagePattern":"legacy audit tree contains a redirect or boundary: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-kernel/src/lib.rs","lineNumber":4347,"sourceCode":"    }\n    if audit_tree_device(&metadata) != root_device || audit_mountpoint(path)? {\n        return Err(std::io::Error::new(\n            std::io::ErrorKind::InvalidData,\n            format!(\n                \"legacy audit tree crosses a filesystem or mount boundary: {}\",\n                path.display()\n            ),\n        ));\n    }\n    astrid_core::platform_fs::verify_no_redirects(path)?;\n    for entry in std::fs::read_dir(path)? {\n        let child = entry?.path();\n        let child_metadata = std::fs::symlink_metadata(&child)?;\n        if child_metadata.file_type().is_symlink()\n            || audit_tree_device(&child_metadata) != root_device\n            || audit_mountpoint(&child)?\n        {\n            return Err(std::io::Error::new(\n                std::io::ErrorKind::InvalidData,\n                format!(\n                    \"legacy audit tree contains a redirect or boundary: {}\",\n                    child.display()\n                ),\n            ));\n        }\n        if child_metadata.is_dir() {\n            validate_audit_tree(&child, root_device)?;\n        } else if child_metadata.is_file() {\n            astrid_core::platform_fs::verify_no_redirects(&child)?;\n        } else {\n            return Err(std::io::Error::new(\n                std::io::ErrorKind::InvalidData,\n                format!(\n                    \"legacy audit tree contains a special file: {}\",\n                    child.display()\n                ),","sourceCodeStart":4329,"sourceCodeEnd":4365,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-kernel/src/lib.rs#L4329-L4365","documentation":"This error is thrown while validating a legacy audit tree directory. The validator walks the tree and refuses any child that is a symlink, resides on a different filesystem device than the root, or is itself a mountpoint, because such redirects/boundaries could make audit data escape the intended tree or be placed on untrusted storage. It is an InvalidData io::Error naming the offending child path.","triggerScenarios":"Calling the audit-tree validation routine (e.g. when opening or migrating a legacy audit store) when any child entry of the tree is a symlink, has a different st_dev than the tree root, or is a mounted filesystem.","commonSituations":"Users replaced an audit log directory with a symlink to another disk; a subdirectory is a separate mount (e.g. tmpfs or NFS bind mount); container images where parts of the audit tree come from overlay mounts.","solutions":["Remove or replace the symlinked/mounted child with a real directory inside the same filesystem","Move the audit tree entirely onto a single filesystem so no child crosses a device boundary","Identify the offending path from the error message and unmount it (umount <child>) before retrying","Restore the audit directory from backup as plain directories/files"],"exampleFix":"// before\nln -s /mnt/big-disk/audit /var/lib/app/audit/events\n// after\nrm /var/lib/app/audit/events\nmkdir /var/lib/app/audit/events","handlingStrategy":"validation","validationCode":"for entry in std::fs::read_dir(audit_root)? {\n    let p = entry?.path();\n    let md = std::fs::symlink_metadata(&p)?;\n    if md.file_type().is_symlink() { return Err(format!(\"symlink: {}\", p.display())); }\n}","typeGuard":"fn is_plain_dir(md: &std::fs::Metadata) -> bool {\n    md.is_dir() && !md.file_type().is_symlink()\n}","tryCatchPattern":"match validate_audit_tree(root, root_dev) {\n    Err(e) if e.kind() == std::io::ErrorKind::InvalidData => eprintln!(\"fix audit tree: {e}\"),\n    Err(e) => return Err(e),\n    Ok(()) => {},\n}","preventionTips":["Never symlink directories inside the audit tree","Keep the audit tree on a single filesystem; avoid submounts","Monitor the tree with a cron check for symlinks/mountpoints","Document the audit directory as managed state"],"tags":["filesystem","symlink","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}