Receive setup-time bubblewrap escape evidence (#79) #83

Merged

adrian.tkacz merged 4 commits from issue-79-bwrap-setup-receipt into develop

2026-10-09 05:50:29 +00:00

kilo commented

2026-10-09 02:45:30 +00:00

Member

Refs #79. Standalone ZCode/GLM-5.3 delivery continuing the owner-ordered sequence after verified #80 integration (PR #82, merged cad1998d8, issue #80 closed). Separate issue, original acceptance criteria; owner ordering #80-before-#79 preserved.

Current Review Subject

Base/mergebase: cad1998d814479cefafe61fe1397fe88fded8b85 (current develop); HEAD: dbb13698d0e3ec574d4cf82fc500a22b3a97a4d5. Four commits; two files (+397/-6): tests/test_bubblewrap_verification.py (+331), docs/adr/0008-linux-bubblewrap-verification.md (+66/-6). No production adapter/ports/core code changed; no dependency/lockfile change; no history rewrite.

Commit history on this branch: (1) 3b5c8b8 receives the #79 evidence; (2) ff2b00b pins synthetic fixture modes against runner umask (group-writable fixtures must refuse, not fail these tests); (3) a4ba20b honors the unprivileged platform gate in the runner-independent refusal receipts; (4) dbb1369 records the delivered-head native-proof case count in the ADR.

Canonical CI history (transparent record)

Runs on the first two heads failed: #2398 (3b5c8b8, 2m6s) and #2399 (ff2b00b, 2m16s); all adjacent runs on other heads succeeded. Job logs are unreachable on this Forgejo (v15.0.8 lacks the v16 jobs/log API; anonymous REST 403; web UI requires sign-in), so the cause was bounded indirectly and fixed in a4ba20b: the new structural receipt tests were the only suite tests invoking the verifier composition outside the native fixture, and the unprivileged profile refuses a root runtime (platform_unsupported) before those receipts — as a root CI runner observes. The final head's tests skip honestly under root and add a deterministic synthesized-root refusal receipt instead. Run #2400 on a4ba20b: SUCCESS (2m28s). No check, gate or security requirement was weakened; no CI configuration changed.

Scope

Receives the #79 setup-time escape evidence for GHSA-pxhw-h44j-8pfx / CVE-2026-87766 that the #80 repin did not claim:

AC3 (core): synthetic native setup-time malicious-symlink/proc-magiclink regression against the exact pinned 0.13.0 utility. Positive control proves the same maintained --dir creation op genuinely writes through a writable bind of real content; both escape vectors (post-pivot /oldroot… host alias; live /proc/<pid>/fd/<fd> magic link) then die during setup ("Can't mkdir parents…"), the candidate never executes, and the synthetic host canary stays byte-identical with no new entry beside it. Direct-utility fixtures use the maintained fail-closed namespace/capability profile; seccomp/PID-1 mask are runtime controls, deliberately absent there; production invocation unchanged.
AC2: structural refusal receipts — unsupported older and fake/branded version strings refuse (native_version), wrong digest refuses (native_provenance), group-/world-writable, symlinked and non-directory scratch trees refuse (scratch_ownership), and the composed invocation is pinned to the fail-closed profile with the 0.13.0 fail-open --not-a-security-boundary flag (bubblewrap.c:2715), any -try namespace variant and --dev-bind absent — plus a deterministic receipt that a root runtime refuses before any launch.
AC1: ADR 0008 records the applicability analysis of the current empty-root/regular-file-snapshot/no-symlink/non-overlapping trusted-resource invocation as a source-backed assessment, explicitly distinguished from the native evidence.
AC4: reaper readiness re-receipt confirmation on the pinned source/binary (do_init 585/611 before 613; bootstrap 3533/3539; forced-interval regressions plus full suite zero-skip on the recorded binary).
AC5: LGPL-2.1-or-later and LICENSE -> COPYING / COPYING.LIB -> COPYING archive-link record confirmed unchanged from the #80 repin.

No weakening of any #50/#80 denial test, timeout, seccomp or namespace requirement; all previous tests preserved. Profile stays verification/test-child only; #53 whole-worker gate separate; no live inference, release or deployment.

Validation

Closed-env make check PASS: 1414 tests + 81 subtests passed; 74 honest skips in a non-root environment (the native-fixture cases), plus up to 8 further honest root-runner structural skips under a root runner, where the new deterministic root-refusal receipt runs instead. make package-check PASS. make audit: no known vulnerabilities. make native-proof PASS: 67 native-proof cases, 0 skipped, on the exact binary 7c0da12cc27c4de4bac5bc1dcf50d19c62a445bdb5f30cb8c9740800b0b8b237 (same digest as the PR #82 receipt; archive e55bdb06… verified). Canonical CI #2400 SUCCESS on a4ba20b; the dbb1369 docs-only remediation re-runs CI on its own head. Full whole-PR independent review at this exact HEAD/base is the next gate (ordinal 4/10; ordinals 1-3 consumed and retained in the delivery ledger). Standalone delivery: no merge authorized.

Refs #79. Standalone ZCode/GLM-5.3 delivery continuing the owner-ordered sequence after verified #80 integration (PR #82, merged cad1998d8, issue #80 closed). Separate issue, original acceptance criteria; owner ordering #80-before-#79 preserved. ## Current Review Subject Base/mergebase: `cad1998d814479cefafe61fe1397fe88fded8b85` (current develop); HEAD: `dbb13698d0e3ec574d4cf82fc500a22b3a97a4d5`. Four commits; two files (+397/-6): `tests/test_bubblewrap_verification.py` (+331), `docs/adr/0008-linux-bubblewrap-verification.md` (+66/-6). No production adapter/ports/core code changed; no dependency/lockfile change; no history rewrite. Commit history on this branch: (1) `3b5c8b8` receives the #79 evidence; (2) `ff2b00b` pins synthetic fixture modes against runner umask (group-writable fixtures must refuse, not fail these tests); (3) `a4ba20b` honors the unprivileged platform gate in the runner-independent refusal receipts; (4) `dbb1369` records the delivered-head native-proof case count in the ADR. ## Canonical CI history (transparent record) Runs on the first two heads failed: #2398 (`3b5c8b8`, 2m6s) and #2399 (`ff2b00b`, 2m16s); all adjacent runs on other heads succeeded. Job logs are unreachable on this Forgejo (v15.0.8 lacks the v16 jobs/log API; anonymous REST 403; web UI requires sign-in), so the cause was bounded indirectly and fixed in `a4ba20b`: the new structural receipt tests were the only suite tests invoking the verifier composition outside the native fixture, and the unprivileged profile refuses a root runtime (`platform_unsupported`) before those receipts — as a root CI runner observes. The final head's tests skip honestly under root and add a deterministic synthesized-root refusal receipt instead. **Run #2400 on `a4ba20b`: SUCCESS (2m28s).** No check, gate or security requirement was weakened; no CI configuration changed. ## Scope Receives the #79 setup-time escape evidence for GHSA-pxhw-h44j-8pfx / CVE-2026-87766 that the #80 repin did not claim: - **AC3 (core)**: synthetic native setup-time malicious-symlink/proc-magiclink regression against the exact pinned 0.13.0 utility. Positive control proves the same maintained `--dir` creation op genuinely writes through a writable bind of real content; both escape vectors (post-pivot `/oldroot…` host alias; live `/proc/<pid>/fd/<fd>` magic link) then die during setup ("Can't mkdir parents…"), the candidate never executes, and the synthetic host canary stays byte-identical with no new entry beside it. Direct-utility fixtures use the maintained fail-closed namespace/capability profile; seccomp/PID-1 mask are runtime controls, deliberately absent there; production invocation unchanged. - **AC2**: structural refusal receipts — unsupported older and fake/branded version strings refuse (`native_version`), wrong digest refuses (`native_provenance`), group-/world-writable, symlinked and non-directory scratch trees refuse (`scratch_ownership`), and the composed invocation is pinned to the fail-closed profile with the 0.13.0 fail-open `--not-a-security-boundary` flag (bubblewrap.c:2715), any `-try` namespace variant and `--dev-bind` absent — plus a deterministic receipt that a root runtime refuses before any launch. - **AC1**: ADR 0008 records the applicability analysis of the current empty-root/regular-file-snapshot/no-symlink/non-overlapping trusted-resource invocation as a source-backed assessment, explicitly distinguished from the native evidence. - **AC4**: reaper readiness re-receipt confirmation on the pinned source/binary (do_init 585/611 before 613; bootstrap 3533/3539; forced-interval regressions plus full suite zero-skip on the recorded binary). - **AC5**: LGPL-2.1-or-later and `LICENSE -> COPYING` / `COPYING.LIB -> COPYING` archive-link record confirmed unchanged from the #80 repin. No weakening of any #50/#80 denial test, timeout, seccomp or namespace requirement; all previous tests preserved. Profile stays verification/test-child only; #53 whole-worker gate separate; no live inference, release or deployment. ## Validation Closed-env `make check` PASS: 1414 tests + 81 subtests passed; 74 honest skips in a non-root environment (the native-fixture cases), plus up to 8 further honest root-runner structural skips under a root runner, where the new deterministic root-refusal receipt runs instead. `make package-check` PASS. `make audit`: no known vulnerabilities. `make native-proof` PASS: 67 native-proof cases, 0 skipped, on the exact binary `7c0da12cc27c4de4bac5bc1dcf50d19c62a445bdb5f30cb8c9740800b0b8b237` (same digest as the PR #82 receipt; archive `e55bdb06…` verified). Canonical CI #2400 SUCCESS on `a4ba20b`; the `dbb1369` docs-only remediation re-runs CI on its own head. Full whole-PR independent review at this exact HEAD/base is the next gate (ordinal 4/10; ordinals 1-3 consumed and retained in the delivery ledger). Standalone delivery: no merge authorized.

kilo added 1 commit

2026-10-09 02:45:30 +00:00