fix(guardrails): unwrap sg/setpriv/prlimit/systemd-run in root-delete (#4685) - #4717
Merged
Merged
Conversation
…delete (#4685) block-root-delete-target ended its launcher walk at any unlisted name, so sg root -c 'rm -rf /', setpriv --reuid=0 rm -rf /, prlimit --nofile=10 rm -rf / and systemd-run rm -rf / all exited 0. setpriv, prlimit and systemd-run join the launcher table with their operand-taking options, and sg re-parses the one word it hands to sh -c. Launcher spellings the walk read one way only are judged on a second reading as well, blocking if either does: an abbreviated env --split-string, an ambiguous nsenter prefix (any operand-taking candidate), su and runuser argv as getopt reads it under an inherited POSIXLY_CORRECT, and sudo's -R / --chroot, operand-taking clusters and abbreviated long options, which were declared gaps. sudo -R rm -rf / stays refused. A replay of the 989 Bash commands the guard suites send, plus the issue's rows, found no command main refuses that this allows, with or without a payload cwd. Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
Contributor
|
PR body contract — issue linkage This PR body does not yet satisfy the issue-linkage contract:
Edit the body and this comment updates itself on the next run. |
Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
Re-bump guardrails to 0.38.2 after 0.38.1 landed. Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
Re-bump guardrails to 0.38.3 after 0.38.2 landed. Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
# Conflicts: # plugins/guardrails/CHANGELOG.md Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
# Conflicts: # plugins/guardrails/CHANGELOG.md Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
# Conflicts: # plugins/guardrails/CHANGELOG.md Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
# Conflicts: # plugins/guardrails/CHANGELOG.md Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4685
Summary
block-root-delete-targetunwrapssg,setpriv,prlimit,systemd-runplus abbreviated long-option readings (env --spl=…,nsenter --t, sudo forms). Issue-measured rc 0 rows now exit 2; benign launcher+lsstays 0.guardrails→ 0.37.6.Test plan