6 Commits

Include renames

Author	SHA1	Message	Date
jochen	2673e7a2c9	Let the setuid search run to its 15-minute bound, ask pacman once, and call a walk with errors incomplete ... The search kept a two-minute limit of its own inside its 15-minute bound, so a long walk always ended incomplete; pacman was asked once per path; and find exiting with an error but some output was read as a complete walk. The bound and the not-judged reasons move to the public rootsearch package so the controller reads the same values (the review of 2026-10-09).	2026-10-09 12:11:57 +02:00
jochen	b28d7bbcbf	Search for setuid programs in the background, and judge each polkit rule alone ... A search over a large disk ran inside the look, holding the judge's lock and stalling the health statement; it now runs apart, serving its last result, backing off after a failure, and saying not judged until it has one. And a rule naming a user, or a comment, no longer hides another rule's unconditional yes (hq ADR 0266).	2026-10-09 10:10:05 +02:00
jochen	d4af8bba1b	Judge an opened file's kind and links below a home, and more ways to root ... A hard link swapped in for ~/.claude would have had root chown another account's file; fstat on the descriptor now refuses a second link, a fifo or an unexpected kind before anything is changed (hq ADR 0266, the re-review). The judge also finds polkit rules for every account, a runtime's API on TCP, setgid-to-root programs whoever owns them, setuid programs on every suid filesystem, and unprotected links; the rest is listed as not judged.	2026-10-09 10:07:52 +02:00
jochen	b89b143fe7	Follow no link below a home as root, and judge more ways to root ... An account could replace ~/.claude with a link to /etc and have the node-engine chown, chmod or write through it on the next apply. Below a person's or an agent's home every component is now opened without following a link, and a link refuses the resource in words. The root judge also reads doas and polkit rules, the container runtimes' sockets with their ACLs, ACLs on the secrets, and setuid-root programs no package owns, in the C locale; Judged and NotJudged write down exactly what it covers (hq ADR 0266 review).	2026-10-09 10:07:52 +02:00
jochen	3a727011ad	Judge whether an account declared never to become root can, so a machine's agents are known confined ... An account an agent runs as (novox/hq ADR 0266) is read on every look for a uid of 0, a group that grants root, any sudo rule and a mesh secret it can read; any way found is unhealthy and said, a read that fails is unknown.	2026-10-09 10:07:35 +02:00
jochen	ab4ca44f98	Give back only the groups the mesh added, and say when a new login is needed (hq ADR 0252, issue 247) ... A module puts the operator's account in a group by declaring the account with that group alone. The node-engine now records each group it added, takes back only those when nothing declared still asks for them, refuses a group the machine lacks before usermod runs, and states each such account as its module's resource of kind account: relogin needed while the running session lacks the group.	2026-10-08 12:04:08 +02:00