novox/hq
6
0
Fork 0
Code Issues Pull Requests 5 Releases Wiki Activity

Issue 361: a setuid find counts only where the agent account can execute it
mesh/merge-gate pass: the change touches no module of the mesh's graph
Details
mesh/repo-check pass: its merge-check.sh passed
Details
mesh/delivery delivered
Details

Browse Source
This commit is contained in:
jochen
2026-10-10 02:00:09 +02:00
parent a8e9a9afd4
commit 2d0a6ba4bc
1 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
04-ISSUES/361-the-control-nodes-agent-account-is-never-judged/01-diagnosis.md
+11 -8
View File
@@ -136,11 +136,14 @@ engine agree. What it found, and what was done:
once complete. But every ask throws a walk away. Asked again and again, it would keep the machine unjudged
for good and its disks busy, and whoever may call a verb includes agents. The operator needs the line only
after a change made by hand.
- **Considered, not built: judge only what the agent account can reach.** A setuid program under another
account's home with mode 0700 cannot be executed by the agent account, because it cannot traverse the
directory. Counting only files whose every parent directory the agent account may traverse would stop the
operator's own copies blocking `root-free`. It is not built, for three reasons. Root or the operator can make
a directory traversable later without any apply, so the verdict would rest on modes that change unseen. ACLs
and group membership have to be read for every parent. A program the agent cannot reach today is still one
no package owns. Deciding it is a change to ADR 0266 §3 item 10, made through playbook 02 if wanted.
- **A find counts only where the agent account can execute it.** The operator asked how the agent account could
reach the two finds at all. It cannot: they sit in the operator's home, which is mode 0700. A setuid- or
setgid-root program no package owns now counts against an account only when that account can execute it.
Every directory from the root down must be searchable for it and the file executable for it, judged by its
uid and all its groups (owner, group or other bits as the kernel picks them). The judge errs towards a way:
a link on the path, a POSIX ACL on any component, or a mode it could not read counts as reachable.
The search still keeps every find. Reachability is read again at every judgement (one `lstat` per path
component), because the operator's account can open its own home without root and no search would see it.
A find in a home is said by count ("in an account's home"), never by path. Its path stays in the engine's
journal line that ends each search. On resolution, ADR 0266 §3 item 10 gains this as a progressive insight
beside the values above.