3 Commits

Include renames

Author	SHA1	Message	Date
jochen	1c61b72f35	Read the homes in one order, so their test does not depend on a map's ... The homes come from a map of the user database, and the test compared them in the order it happened to iterate: it failed one run in four, the repo check of 2026-10-09 among them.	2026-10-09 12:36:56 +02:00
jochen	d4af8bba1b	Judge an opened file's kind and links below a home, and more ways to root ... A hard link swapped in for ~/.claude would have had root chown another account's file; fstat on the descriptor now refuses a second link, a fifo or an unexpected kind before anything is changed (hq ADR 0266, the re-review). The judge also finds polkit rules for every account, a runtime's API on TCP, setgid-to-root programs whoever owns them, setuid programs on every suid filesystem, and unprotected links; the rest is listed as not judged.	2026-10-09 10:07:52 +02:00
jochen	b89b143fe7	Follow no link below a home as root, and judge more ways to root ... An account could replace ~/.claude with a link to /etc and have the node-engine chown, chmod or write through it on the next apply. Below a person's or an agent's home every component is now opened without following a link, and a link refuses the resource in words. The root judge also reads doas and polkit rules, the container runtimes' sockets with their ACLs, ACLs on the secrets, and setuid-root programs no package owns, in the C locale; Judged and NotJudged write down exactly what it covers (hq ADR 0266 review).	2026-10-09 10:07:52 +02:00