jschoubben
f444e8599b
The control-node withholds execute through its holder's setting since ADR 0268, so probe D-root read a closed path as open. It now counts the verb as served while the holder's setting for that machine is serve, or the bus hears execute answered there, or the bus could not be asked: a withheld value not yet pushed, or a holder answering against its setting, is never taken for closed.
273 lines
11 KiB
Go
273 lines
11 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"slices"
|
|
"sort"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/novox/mesh-controller/internal/catalogue"
|
|
"github.com/novox/mesh-controller/internal/conditions"
|
|
"github.com/novox/mesh-controller/internal/link"
|
|
)
|
|
|
|
// The self-check's probe of who can become root where the trusted parties run (novox/hq ADR 0259 §8, rule 3).
|
|
//
|
|
// The router and every channel proving its sender run as accounts of their own, so that no agent reads what
|
|
// they hold or speaks as them. **Root on their machine undoes all of it.** So on every machine where a module
|
|
// of its own account runs, this probe asks two questions, and raises an urgent condition while either is yes:
|
|
//
|
|
// 1. can an account an agent runs as become root without a person there — passwordless sudo, or a group
|
|
// that is root by another name (docker, disk)? The agent's account is the one the coding-agent module on
|
|
// that machine names (`agent_account`), and the operator's account while it names none;
|
|
// 2. can an agent run a command it chooses, through the mesh's own tools, as an account that can — the login
|
|
// shell's `execute` runs as the machine's runtime account, which the mesh's acting tools give passwordless
|
|
// sudo? **Only where `execute` is served** (novox/hq ADR 0268): `execute` is an optional verb its holder
|
|
// withholds on a machine whose `execute` setting is not `serve`. The holder's seat being held there says
|
|
// nothing; whether the verb is served does. It counts as served while either says so — the holder's
|
|
// setting as the controller resolves it for that machine (a withheld value not yet pushed is still served),
|
|
// or the bus's discovery hearing the verb answered there — so a withheld setting the machine has not acted
|
|
// on yet, or a holder answering against its setting, is never taken for closed.
|
|
//
|
|
// The measurement is the sudo module's on that machine (`sudo_escalation`); a machine it does not run on, or
|
|
// that does not answer, is a probe that could not run — said, never taken for "no".
|
|
|
|
// kindAgentRoot is the condition an agent able to become root where a trusted party runs raises.
|
|
const kindAgentRoot = "agent-root"
|
|
|
|
// The tools the probe asks, of the modules on each machine.
|
|
const (
|
|
agentModule = "claude-code"
|
|
agentStatusTool = "claude_code_status"
|
|
sudoModule = "sudo"
|
|
sudoEscalation = "sudo_escalation"
|
|
loginShellSeat = "node-login-shell"
|
|
// loginShellVerb is the seat's verb that runs a command, and the name of the setting its holder withholds
|
|
// it by (novox/hq ADR 0268).
|
|
loginShellVerb = "execute"
|
|
// executeServes is the one value of that setting that serves the verb; anything else withholds it.
|
|
executeServes = "serve"
|
|
)
|
|
|
|
// loginShellServed judges whether the login shell's execute is served on a machine, failing closed (novox/hq
|
|
// ADR 0268): served while the holder's setting there is `serve` (or the holder has no such setting and claims
|
|
// the verb), or while the bus heard the verb answered there, or while the bus could not be asked. why says
|
|
// which, in words, for the condition.
|
|
func loginShellServed(holder string, claims bool, setting *any, heard, asked bool) (bool, string) {
|
|
var why []string
|
|
switch {
|
|
case setting != nil:
|
|
if v, _ := (*setting).(string); v == executeServes {
|
|
why = append(why, holder+"'s execute setting there is "+executeServes)
|
|
}
|
|
case claims:
|
|
why = append(why, holder+" claims execute and has no setting that withholds it")
|
|
}
|
|
if heard {
|
|
why = append(why, "the bus hears execute answered there")
|
|
} else if !asked {
|
|
why = append(why, "the bus could not be asked whether execute is answered there")
|
|
}
|
|
return len(why) > 0, strings.Join(why, "; ")
|
|
}
|
|
|
|
// claimServes says whether a manifest's claim of a seat names a verb among those it serves.
|
|
func claimServes(m catalogue.Manifest, seat, verb string) bool {
|
|
for _, c := range m.Claims {
|
|
if c.Name == seat && slices.Contains(c.Serves, verb) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// escalation is the sudo module's answer for one account.
|
|
type escalation struct {
|
|
Account string `json:"account"`
|
|
Root bool `json:"root_without_a_person"`
|
|
Why string `json:"why"`
|
|
}
|
|
|
|
// agentRootFacts is what one machine says, as the probe reads it.
|
|
type agentRootFacts struct {
|
|
Machine string
|
|
Trusted []string // the modules of their own account on it
|
|
Agent string // the account agents run as there; "" when none run there
|
|
AgentNamed bool // the coding-agent module named it, rather than it being taken for the operator's
|
|
Runtime string // the account the machine's runtime runs as
|
|
LoginShell bool // the login shell's execute is served there, running commands as the runtime's account
|
|
// LoginShellWhy is why execute counts as served there, in words: its holder's setting, the bus, or both.
|
|
LoginShellWhy string
|
|
Answers map[string]escalation
|
|
}
|
|
|
|
// agentRootObservations judges one machine's facts: an urgent condition while an agent can become root there
|
|
// without a person, one way or the other, naming which.
|
|
func agentRootObservations(f agentRootFacts) []conditions.Observation {
|
|
var ways []string
|
|
if f.Agent != "" {
|
|
if e := f.Answers[f.Agent]; e.Root {
|
|
named := "the operator's account, which agents run as while the coding-agent module names no other"
|
|
if f.AgentNamed {
|
|
named = "the account agents run as"
|
|
}
|
|
ways = append(ways, fmt.Sprintf("%s (%s) can become root without a person: %s", f.Agent, named, e.Why))
|
|
}
|
|
}
|
|
if f.LoginShell && f.Runtime != "" {
|
|
if e := f.Answers[f.Runtime]; e.Root {
|
|
served := ""
|
|
if f.LoginShellWhy != "" {
|
|
served = " (" + f.LoginShellWhy + ")"
|
|
}
|
|
ways = append(ways, fmt.Sprintf("the login shell runs any command an agent gives it as %s%s, which can "+
|
|
"become root without a person: %s", f.Runtime, served, e.Why))
|
|
}
|
|
}
|
|
if len(ways) == 0 {
|
|
return nil
|
|
}
|
|
sort.Strings(f.Trusted)
|
|
return []conditions.Observation{{Scope: conditions.ScopeMachine, ID: f.Machine, Token: kindAgentRoot,
|
|
Machine: f.Machine, Kind: kindAgentRoot, Severity: conditions.Urgent,
|
|
Summary: fmt.Sprintf("an agent can become root on %s without a person, where %s run as accounts of their "+
|
|
"own; until it cannot, the router approves nothing proven there (novox/hq ADR 0259 §8): %s",
|
|
f.Machine, strings.Join(f.Trusted, ", "), strings.Join(ways, "; ")),
|
|
Headline: "Root without you on " + f.Machine,
|
|
Needs: "choose how programs working for you on " + f.Machine + " stop becoming root without asking you.",
|
|
Explanation: "The modules that prove your answers from your phone run on " + f.Machine + ", and a program " +
|
|
"working for you there can become root without asking you, so it could answer in your name. Until " +
|
|
"that changes, answers from your phone can only acknowledge.",
|
|
Resolved: "Nothing on " + f.Machine + " becomes root without you any more"}}
|
|
}
|
|
|
|
// probeAgentRoot is the probe: every machine a module of its own account runs on, judged.
|
|
func probeAgentRoot(ctx context.Context, d *doctor) ([]conditions.Observation, error) {
|
|
inv := d.open.inventory
|
|
entries, err := inv.Catalogued(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
facts := map[string]*agentRootFacts{}
|
|
agentOn, sudoOn := map[string]bool{}, map[string]bool{}
|
|
for _, e := range entries {
|
|
for _, node := range e.On {
|
|
switch {
|
|
case e.Manifest.RunsAs != "":
|
|
f := facts[node]
|
|
if f == nil {
|
|
f = &agentRootFacts{Machine: node, Answers: map[string]escalation{}}
|
|
facts[node] = f
|
|
}
|
|
f.Trusted = append(f.Trusted, e.Manifest.Module)
|
|
case e.Manifest.Module == agentModule:
|
|
agentOn[node] = true
|
|
case e.Manifest.Module == sudoModule:
|
|
sudoOn[node] = true
|
|
}
|
|
}
|
|
}
|
|
machines := make([]string, 0, len(facts))
|
|
for m := range facts {
|
|
machines = append(machines, m)
|
|
}
|
|
sort.Strings(machines)
|
|
var out []conditions.Observation
|
|
var unread []string
|
|
if len(machines) == 0 {
|
|
return nil, nil
|
|
}
|
|
// Whether the login shell's execute is served where a trusted party runs (novox/hq ADR 0268): the
|
|
// holder's setting for that machine, and what the bus hears answered there. A discovery that could not be
|
|
// asked leaves only the setting, which is said: the probe then cannot show the verb withheld.
|
|
heard, derr := discoverSeatVerbs(ctx, d.js.Conn())
|
|
if derr != nil {
|
|
unread = append(unread, "the bus's discovery could not be asked whether the login shell's execute is served: "+derr.Error())
|
|
}
|
|
for _, e := range entries {
|
|
if !e.Manifest.ClaimsSeat(loginShellSeat) {
|
|
continue
|
|
}
|
|
for _, node := range e.On {
|
|
f := facts[node]
|
|
if f == nil {
|
|
continue
|
|
}
|
|
var setting *any
|
|
if _, declared := e.Manifest.Settings[loginShellVerb]; declared {
|
|
layers, err := inv.SettingsFor(ctx, node, e.Manifest.Module)
|
|
if err != nil {
|
|
unread = append(unread, node+": "+e.Manifest.Module+"'s settings could not be read: "+err.Error())
|
|
f.LoginShell, f.LoginShellWhy = true, "its holder's setting could not be read"
|
|
continue
|
|
}
|
|
for _, s := range catalogue.Effective(e.Manifest, layers) {
|
|
if s.Key == loginShellVerb {
|
|
v := s.Value
|
|
setting = &v
|
|
}
|
|
}
|
|
}
|
|
f.LoginShell, f.LoginShellWhy = loginShellServed(e.Manifest.Module, claimServes(e.Manifest, loginShellSeat, loginShellVerb),
|
|
setting, heard[loginShellSeat][loginShellVerb][node], derr == nil)
|
|
}
|
|
}
|
|
for _, m := range machines {
|
|
f := facts[m]
|
|
record, err := inv.NodeByName(ctx, m)
|
|
if err != nil {
|
|
unread = append(unread, m+": "+err.Error())
|
|
continue
|
|
}
|
|
f.Runtime = record.Account
|
|
if agentOn[m] {
|
|
f.Agent = record.Account
|
|
if a, err := link.AskModuleToolOn(ctx, d.js.Conn(), agentModule, agentStatusTool, m, map[string]any{}, 10*time.Second); err == nil && a.Error == "" {
|
|
var status struct {
|
|
AgentAccount string `json:"agent_account"`
|
|
}
|
|
if json.Unmarshal(a.Result, &status) == nil && status.AgentAccount != "" {
|
|
f.Agent, f.AgentNamed = status.AgentAccount, true
|
|
}
|
|
}
|
|
}
|
|
if !sudoOn[m] {
|
|
unread = append(unread, m+": the sudo module is not assigned there, so who can become root is not measured")
|
|
continue
|
|
}
|
|
var accounts []string
|
|
for _, a := range []string{f.Agent, f.Runtime} {
|
|
if a != "" && !slices.Contains(accounts, a) {
|
|
accounts = append(accounts, a)
|
|
}
|
|
}
|
|
if len(accounts) == 0 {
|
|
continue
|
|
}
|
|
a, err := link.AskModuleToolOn(ctx, d.js.Conn(), sudoModule, sudoEscalation, m, map[string]any{"accounts": accounts}, 15*time.Second)
|
|
if err == nil && a.Error != "" {
|
|
err = fmt.Errorf("%s", a.Error)
|
|
}
|
|
if err != nil {
|
|
unread = append(unread, m+": "+err.Error())
|
|
continue
|
|
}
|
|
var answers []escalation
|
|
if err := json.Unmarshal(a.Result, &answers); err != nil {
|
|
unread = append(unread, m+": the sudo module's answer could not be read: "+err.Error())
|
|
continue
|
|
}
|
|
for _, e := range answers {
|
|
f.Answers[e.Account] = e
|
|
}
|
|
out = append(out, agentRootObservations(*f)...)
|
|
}
|
|
if len(unread) > 0 {
|
|
return out, fmt.Errorf("who can become root could not be measured: %s", strings.Join(unread, "; "))
|
|
}
|
|
return out, nil
|
|
}
|