6 Commits

Include renames

Author	SHA1	Message	Date
jochen	0b4c86e3be	Count a setuid find only where the account can execute it, read at every judgement (hq issue 361) ... The two finds on the control-node sit in the operator's home of mode 0700, which the agent account cannot search. The search keeps every find; each judgement reads the modes on the way again, since an account can open its own home without root. A find in a home is said by count, its path in the journal alone. Also from review: a checkpoint racing SearchNow forgets the walk it just kept, and a walk kept by an older engine says its counts as lower bounds.	2026-10-10 02:00:10 +02:00
jochen	2dbbda51c6	Walk for setuid programs in the engine and carry an interrupted walk on (hq issue 361) ... The control-node's walk takes far longer than the engine runs between updates, so a search that starts over at every restart never completes. The walk is the engine's own, in lexical order, so its progress is one cursor per filesystem, kept every minute beside the engine's state and carried on after a restart while younger than rootsearch.FreshFor. It runs on a thread of its own at nice 19 and the idle I/O class.	2026-10-10 01:00:47 +02:00
jochen	2673e7a2c9	Let the setuid search run to its 15-minute bound, ask pacman once, and call a walk with errors incomplete ... The search kept a two-minute limit of its own inside its 15-minute bound, so a long walk always ended incomplete; pacman was asked once per path; and find exiting with an error but some output was read as a complete walk. The bound and the not-judged reasons move to the public rootsearch package so the controller reads the same values (the review of 2026-10-09).	2026-10-09 12:11:57 +02:00
jochen	d4af8bba1b	Judge an opened file's kind and links below a home, and more ways to root ... A hard link swapped in for ~/.claude would have had root chown another account's file; fstat on the descriptor now refuses a second link, a fifo or an unexpected kind before anything is changed (hq ADR 0266, the re-review). The judge also finds polkit rules for every account, a runtime's API on TCP, setgid-to-root programs whoever owns them, setuid programs on every suid filesystem, and unprotected links; the rest is listed as not judged.	2026-10-09 10:07:52 +02:00
jochen	b89b143fe7	Follow no link below a home as root, and judge more ways to root ... An account could replace ~/.claude with a link to /etc and have the node-engine chown, chmod or write through it on the next apply. Below a person's or an agent's home every component is now opened without following a link, and a link refuses the resource in words. The root judge also reads doas and polkit rules, the container runtimes' sockets with their ACLs, ACLs on the secrets, and setuid-root programs no package owns, in the C locale; Judged and NotJudged write down exactly what it covers (hq ADR 0266 review).	2026-10-09 10:07:52 +02:00
jochen	3a727011ad	Judge whether an account declared never to become root can, so a machine's agents are known confined ... An account an agent runs as (novox/hq ADR 0266) is read on every look for a uid of 0, a group that grants root, any sudo rule and a mesh secret it can read; any way found is unhealthy and said, a read that fails is unknown.	2026-10-09 10:07:35 +02:00