Repository navigation
policy: nothing is granted below a file (#686) - #704
Merged
Merged
Conversation
walkLinks reported walkLanded for a path below a generated file and below a bind whose host side is a file, so GrantsGuestPath printed no `← not granted` mark and sanitise kept the element, while the kernel answers ENOTDIR inside. Those arms now end walkNowhere. A file inside a writable (or aliased) directory bind still lands: the payload can rm it and mkdir its own. Coupling: a `file` grant covers only its own path. A bind of a host file still covers downward there, because coupling is computed over profile text and file-or-directory is host state; --dry-run marks the value and sanitise drops it instead. fakeEnv.Lstat answers ENOTDIR below a fixture file, as lstat(2) does. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
AccessRW KindData is bwrap's --file: a plain file written into its parent, not a mountpoint. On a writable tmpfs or rw bind the payload can rm it and mkdir its own directory (measured: --file REPLACED, --ro-bind-data EBUSY), so a path below it lands replaceable instead of walkNowhere. The old walk called it NotSlot too; the #686 change made that arm a stated claim, so it now has to be true. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #686.
walkLinksreportedwalkLandedfor path below a file. Kernel answers ENOTDIR inside. Effect: no← not grantedon--dry-run,sanitisekept element, coupling accepted value.Change:
walkLinks: below a file endswalkNowhere(GrantsGuestPath false, keepHostElement DropNoGrant, Shadow NotSlot). Three arms: KindData with path left; host ENOTDIR under a bind (only at a bind root that is a file, a mountpoint); host non-dir with path left.--file, plain file, not mountpoint) on writable ground. The last wasNotSlotbefore this branch too.filegrant covers own path only. Bind of host file still covers downward: coupling is text-only, file-vs-dir is host state; screen mark + sanitise handle it.fakeEnv.Lstatanswers ENOTDIR below fixture file, like lstat(2).Measured, bwrap, tmpfs parent:
--filethenrm && mkdir-> REPLACED;--ro-bind-data->Device or resource busy; rw bind of a file -> rm/mvDevice or resource busy, mkdir belowNot a directory.Issue repro, old vs new build:
/srv/cfile,KUBECONFIG=/srv/cfile/sub/x: rc=0 -> rc=77 "which it does not grant"ro = ["/etc/hostname:/srv/hn"],KUBECONFIG=/srv/hn/sub/x: no mark ->← not grantedPATH=/opt/tool/bin:..., file bind at/opt/tool, sanitise PATH: kept -> dropped "nothing grants that path: /opt/tool/bin"Tests:
TestNothingIsGrantedBelowAFile,TestAFileInsideAWritableDirectoryStillAnswersBelowIt,TestAWritableGeneratedFileOnWritableGroundIsASlotBelowIt,TestCouplingFileGrantCoversOnlyItsOwnPath; each made to fail against code with its arm reverted.TestEarlyLandingNeverMatchesAnExactPath: file case moved to rw bind, generated-file case dropped (now walkNowhere).Redteam, two rounds before PR. Round 1 stopped early, unmeasured; its lead gave the
--filefix. Round 2, live sandbox: no mismatch in the dangerous direction (ro bind + rw alias at other guest path, profilefilein tmpfs, host links to a file — each writable case marked and SHADOW-RAN; each unmarked case ENOTDIR inside). Safe-direction over-mark noted: rw bind of the file itself marked writable, cannot be taken over (EROFS/ENOTDIR).make gategreen.make integration/make verifynot run (policy-pure change).Book facts: #700 comment §6.
🤖 Generated with Claude Code