Track revoke-report coverage beyond D367 bounded checks #429

New issue

Open

opened 2026-11-08 14:41:59 +00:00 by kayg · 0 comments

kayg commented

2026-11-08 14:41:59 +00:00

Owner

D367 explicitly ships the bounded revoke scan with a coverage caveat. Track the remaining routes from J366 here, after #355 integrates:

pam_cap / /etc/security/capability.conf grants: no capability audit in this scan.
Subordinate-uid mappings, especially an allocated range containing host uid 0; container processes outside the stopped sessions/user slice may not share the account uid and are not attributed by /proc UID matching.
Setuid-root binaries: no host-wide audit of ownership, writability or execution policy.
Root-job indirect inputs (libraries, sourced files, data consumed by a root program, arbitrary executable graphs) remain outside the bounded direct-target/unit-file scan. Ambiguous direct commands fail closed.
Uninstantiated systemd templates are definitions rather than scheduled jobs; their instantiated/live services are covered.

This is follow-up tracking, not approval to expand the current job. Owner D367 chooses the caveat and one final review rather than an unbounded privilege audit. The CLI clean sentence must say: Access outside these checks isn't covered.

D367 explicitly ships the bounded revoke scan with a coverage caveat. Track the remaining routes from J366 here, after #355 integrates: - pam_cap / /etc/security/capability.conf grants: no capability audit in this scan. - Subordinate-uid mappings, especially an allocated range containing host uid 0; container processes outside the stopped sessions/user slice may not share the account uid and are not attributed by /proc UID matching. - Setuid-root binaries: no host-wide audit of ownership, writability or execution policy. - Root-job indirect inputs (libraries, sourced files, data consumed by a root program, arbitrary executable graphs) remain outside the bounded direct-target/unit-file scan. Ambiguous direct commands fail closed. - Uninstantiated systemd templates are definitions rather than scheduled jobs; their instantiated/live services are covered. This is follow-up tracking, not approval to expand the current job. Owner D367 chooses the caveat and one final review rather than an unbounded privilege audit. The CLI clean sentence must say: Access outside these checks isn't covered.

kayg referenced this issue

2026-11-08 14:41:59 +00:00

Gate flakes, round 2 #355

kayg referenced this issue

2026-11-08 15:15:35 +00:00

Gate flakes, round 2 #355

kayg referenced this issue

2026-11-08 18:15:23 +00:00

Gate flakes, round 2 #355

kayg referenced this issue

2026-11-08 19:07:42 +00:00

revoke report: routes not covered #437