4 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	5dc3a8e17f	Keep what an archive unpacked in the engine's own state directory, never beside the archive, and stop no slower than the host waits (issue 1585, review round 1) ... The journal of an unpack sat at <target>.unpacked.json, in a directory the module's account may write: a forged one would make the root engine remove or adopt any path it named. It now lives under <statedir>/unpacked/<sha256 of the target>.json, mode 0600, names its target, and is refused whole when an entry is not filepath.IsLocal or a parent is not above the target. It goes when the archive is taken off, whether its state record still said what it unpacked or not. The launcher's stop grace for a host on trial rises from 20 s to 75 s and the unit's TimeoutStopSec is 120 s (openrc the same), past the host's own 60 s wait for the apply in flight, so neither cuts a save off again. Tests folded as rows into existing ones (the repository is over its unit budget): the journal's rows, a forged entry and parent refused, the journal gone with a record that lost its Unpacked; the test that passed on main dropped; the stop test waits on its own line, not a sleep, and no longer consumes the save it waits for. Claude-Session: https://claude.ai/code/session_01JG73KG7AfSdh6FP8VrBqCn	2026-11-04 10:52:42 +01:00
jochen	1c61b72f35	Read the homes in one order, so their test does not depend on a map's ... The homes come from a map of the user database, and the test compared them in the order it happened to iterate: it failed one run in four, the repo check of 2026-10-09 among them.	2026-10-09 12:36:56 +02:00
jochen	d4af8bba1b	Judge an opened file's kind and links below a home, and more ways to root ... A hard link swapped in for ~/.claude would have had root chown another account's file; fstat on the descriptor now refuses a second link, a fifo or an unexpected kind before anything is changed (hq ADR 0266, the re-review). The judge also finds polkit rules for every account, a runtime's API on TCP, setgid-to-root programs whoever owns them, setuid programs on every suid filesystem, and unprotected links; the rest is listed as not judged.	2026-10-09 10:07:52 +02:00
jochen	b89b143fe7	Follow no link below a home as root, and judge more ways to root ... An account could replace ~/.claude with a link to /etc and have the node-engine chown, chmod or write through it on the next apply. Below a person's or an agent's home every component is now opened without following a link, and a link refuses the resource in words. The root judge also reads doas and polkit rules, the container runtimes' sockets with their ACLs, ACLs on the secrets, and setuid-root programs no package owns, in the C locale; Judged and NotJudged write down exactly what it covers (hq ADR 0266 review).	2026-10-09 10:07:52 +02:00