jochen c74cf16b75 Judge an opened file's kind and links below a home, and more ways to root ...

A hard link swapped in for ~/.claude would have had root chown another
account's file; fstat on the descriptor now refuses a second link, a fifo or
an unexpected kind before anything is changed (hq ADR 0266, the re-review).
The judge also finds polkit rules for every account, a runtime's API on TCP,
setgid-to-root programs whoever owns them, setuid programs on every suid
filesystem, and unprotected links; the rest is listed as not judged.

2026-10-08 21:19:32 +02:00

..

accounts_test.go

Give back only the groups the mesh added, and say when a new login is needed (hq ADR 0252, issue 247)

2026-10-08 12:04:08 +02:00

accounts.go

Judge whether an account declared never to become root can, so a machine's agents are known confined

2026-10-08 18:30:10 +02:00

exec.go

Follow no link below a home as root, and judge more ways to root

2026-10-08 20:36:46 +02:00

root_test.go

Judge an opened file's kind and links below a home, and more ways to root

2026-10-08 21:19:32 +02:00

ways_test.go

Judge an opened file's kind and links below a home, and more ways to root

2026-10-08 21:19:32 +02:00

ways.go

Judge an opened file's kind and links below a home, and more ways to root

2026-10-08 21:19:32 +02:00