Issue 361: the setuid search shows its progress, and the operator can ask for a fresh one at the terminal

Co-Authored-By: Claude <noreply@anthropic.com>
2026-10-10 01:55:52 +02:00
parent c2d98bc61b
commit a8e9a9afd4
2 changed files with 36 additions and 1 deletions
@@ -2,7 +2,7 @@
 layer: to-be
 status: in-progress
 code: [mesh-controller, mesh-host, mesh-tools, mesh-catalog, mesh-sdk, mesh-lab]
-updated: 2026-10-09
+updated: 2026-10-10
 decisions:
  - 02-DECISIONS/0271-a-send-held-for-the-buss-planned-step-is-told-to-the-operator-at-once-and-a-change-that-needs-it-says-so-before-it-merges.md
  - 02-DECISIONS/0265-a-verb-that-reads-is-answered-on-the-serving-controllers-own-connection-and-every-connection-says-what-it-is.md
@@ -73,6 +73,7 @@ Every kind of state the core keeps, and the one component that writes it. Anyone
 |---|---|---|---|
 | a machine's declaration | controller (lease holder) | the bus, last per subject | read |
 | a hand-over asked of a machine ([issue 356](../../04-ISSUES/356-the-operators-command-ran-a-stale-engine-and-a-hand-over-had-no-channel/00-report.md)) | controller, at its terminal | the machine, beside its state | the engine verifies the mesh's signature and records it, or refuses |
+| a fresh setuid search asked of a machine ([issue 361](../../04-ISSUES/361-the-control-nodes-agent-account-is-never-judged/00-report.md)) | controller, at its terminal | the machine, which throws its last search away | the engine verifies the mesh's signature and starts it, or refuses |
 | a machine's applied state and its report | the node-engine's apply queue (§6) | the machine; the report on the bus | the reconcile and a delivery *enqueue*, never apply |
 | the controller lease | the controller instance holding it | key-value `mesh-controller_lease` | a candidate waits |
 | plans and their tiers | controller (lease holder), compare-and-set on the plan's revision | the controller's store | read through `plans` |
@@ -110,3 +110,37 @@ engine agree. What it found, and what was done:
  every searched filesystem would report each change of mode or owner as it happens, turning the daily walk into
  a true incremental search.
 - **Resolution** of this core issue needs a replay in mesh-lab's register, or `replay-none:` with the reason.
+
+## 2026-10-10 — the search shows its progress, and the operator can ask for a fresh one
+
+- **The progress was kept and seen by nobody.** At 01:40 the operator asked how far the first walk on the
+  control-node had got. The walk kept its progress every minute beside the engine's state, but `root-free` said
+  only "not judged yet (search running), started 01:27", and no tool read further. The node-engine serves no
+  tools of its own, so the progress now travels where the verdict already does: the agent account's verdict
+  carries it as fields, and its reason gains one line that `root-free` repeats. The line holds filesystems done
+  of the total, the mount point being walked, the entries visited, the setuid- or setgid-root files found so far,
+  when the progress was last kept, and how long each finished filesystem took. Counts, times and mount points
+  only: the cursor and every file found are often under an account's home, and stay in the engine's state and
+  journal. The line moves at each checkpoint (once a minute) and is never part of what makes a verdict
+  "changed", so the journal does not repeat it every minute; the statement is said every minute anyway while
+  the account is not healthy. An entry is counted once across a resume, as it is kept with the cursor it
+  matches. The time a filesystem took counts only the time the engine walked it, not the time it was stopped.
+- **A change by hand was not searched for until the next day.** The first complete search on the control-node
+  ended at about 01:48 and found two setuid-root programs no package owns, copies in the operator's home. When the
+  operator removes them by hand, no apply says so, and nothing searches again until the daily search. The
+  operator now asks for one at the controller's terminal: `nox node setuid-search <node>` on the control-node.
+  The controller signs the ask with the mesh's key, as it signs a hand-over, under a signing context of its own.
+  The engine throws away the last complete search and any walk under way or kept, and the next look starts a
+  full search. Until it completes, the verdict is "not judged yet", with its progress.
+- **Why at the terminal alone, not a verb.** A search can never make a machine root-free wrongly: it judges only
+  once complete. But every ask throws a walk away. Asked again and again, it would keep the machine unjudged
+  for good and its disks busy, and whoever may call a verb includes agents. The operator needs the line only
+  after a change made by hand.
+- **Considered, not built: judge only what the agent account can reach.** A setuid program under another
+  account's home with mode 0700 cannot be executed by the agent account, because it cannot traverse the
+  directory. Counting only files whose every parent directory the agent account may traverse would stop the
+  operator's own copies blocking `root-free`. It is not built, for three reasons. Root or the operator can make
+  a directory traversable later without any apply, so the verdict would rest on modes that change unseen. ACLs
+  and group membership have to be read for every parent. A program the agent cannot reach today is still one
+  no package owns. Deciding it is a change to ADR 0266 §3 item 10, made through playbook 02 if wanted.
+