4 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	c7b534a08c	Keep a module directory's setgid bit, warn about a refused runner, and restart the runner when it leaves (hq ADR 0334 review) ... A module's own directories need setgid so what is made beneath keeps its own group, and a mode of 2750 refused the whole declaration while every apply dropped the bit: a directory's mode now carries setgid (never setuid or sticky), set, kept and said. A tool runner's account that is missing or root's failed the whole apply and dropped the library's outcome: it is now a warning, said as runner:<module> or runner:library:<name>. And a runner that leaves a group is taken out before the resources apply, so its unit is restarted in that apply to lose it.	2026-10-13 00:11:50 +02:00
jochen	fc6c5a92e6	Believe a hand-over only signed by the mesh, and give it through no link (hq issue 356, review) ... Two holes the review proved. The ask's subject proved nothing — a responder can reach it through a reply — so the engine now verifies the mesh's signature over a fixed context with the key it verifies declarations with, before reading anything, and refuses an ask for another node, expired, good too long, without a nonce, or replayed. And the apply followed a link the hand-over had refused: a component swapped for a link after the record carried root's chmod and chown to its target. A handed-over directory must now still resolve to itself, and is changed only through one descriptor opened from / with no link followed (fchmod, fchown). Tests for the reply guard, the run loop's hook, the fallback renewal on proof and a non-regular fallback; 27 checks each removed in turn, each failing a test.	2026-10-09 19:45:00 +02:00
jochen	d4af8bba1b	Judge an opened file's kind and links below a home, and more ways to root ... A hard link swapped in for ~/.claude would have had root chown another account's file; fstat on the descriptor now refuses a second link, a fifo or an unexpected kind before anything is changed (hq ADR 0266, the re-review). The judge also finds polkit rules for every account, a runtime's API on TCP, setgid-to-root programs whoever owns them, setuid programs on every suid filesystem, and unprotected links; the rest is listed as not judged.	2026-10-09 10:07:52 +02:00
jochen	b89b143fe7	Follow no link below a home as root, and judge more ways to root ... An account could replace ~/.claude with a link to /etc and have the node-engine chown, chmod or write through it on the next apply. Below a person's or an agent's home every component is now opened without following a link, and a link refuses the resource in words. The root judge also reads doas and polkit rules, the container runtimes' sockets with their ACLs, ACLs on the secrets, and setuid-root programs no package owns, in the C locale; Judged and NotJudged write down exactly what it covers (hq ADR 0266 review).	2026-10-09 10:07:52 +02:00