revoke report: routes not covered #437

New issue

Open

opened 2026-11-08 19:07:42 +00:00 by kayg · 0 comments

kayg commented

2026-11-08 19:07:42 +00:00

Owner

Routes found during J391's final review of the D367 revoke report (#355). Each is outside D367's list: they are candidates for later checks, not defects in the shipped ones, and they're tracked here per D367 ("the remaining routes are tracked in an issue"). See also #429 (J345's list: pam_cap, subordinate uids, setuid audit, indirect root-job inputs, uninstantiated templates).

Ways a revoked person can keep root, or write later, that the report does not look at:

Writable root policy files that are not active yet. sudo -l -U reads the policy in force today. A /etc/sudoers.d file or directory the account can write is not checked, so the person can grant themselves sudo after the revoke. The doas and polkit checks already reject writable policy paths; sudo has no such check.
/etc/anacrontab. Its jobs run as root. Neither the file nor the scripts it names are inspected.
Root at jobs (/var/spool/cron/atjobs, /var/spool/at): queued scripts that run as root later.
Other root-run hooks: /etc/logrotate.d (postrotate runs as root), udev RUN+= rules (/etc/udev/rules.d), NetworkManager dispatcher scripts, /etc/network/if-*.d, apt/dpkg hooks (/etc/apt/apt.conf.d DPkg::Post-Invoke), /etc/ld.so.preload and /etc/ld.so.conf.d, /etc/pam.d. If the account can write any of these, or a script they name, root runs its code.
Other root daemon sockets: /run/podman/podman.sock, /var/lib/incus/unix.socket, /var/snap/lxd/common/lxd/unix.socket, /run/libvirt/libvirt-sock. These are reachable through ACLs or custom groups; today only the docker and containerd paths are probed.
Non-root accounts' scheduled work (their crontabs and system units running as them) whose scripts the revoked account can write. That isn't root, but it lets the person write as another host account later.
.path units whose watched path the account can write. They trigger root services when that path changes. The service's own inputs are checked; the trigger is not reported.

None of these were confirmed live in this review. They come from reading the code against the checks it names. No owner decision is requested here; prioritise after #355 merges.

Routes found during J391's final review of the D367 revoke report (#355). Each is **outside D367's list**: they are candidates for later checks, not defects in the shipped ones, and they're tracked here per D367 ("the remaining routes are tracked in an issue"). See also #429 (J345's list: pam_cap, subordinate uids, setuid audit, indirect root-job inputs, uninstantiated templates). Ways a revoked person can keep root, or write later, that the report does not look at: 1. **Writable root policy files that are not active yet.** `sudo -l -U` reads the policy in force today. A `/etc/sudoers.d` file or directory the account can write is not checked, so the person can grant themselves sudo after the revoke. The doas and polkit checks already reject writable policy paths; sudo has no such check. 2. **`/etc/anacrontab`.** Its jobs run as root. Neither the file nor the scripts it names are inspected. 3. **Root `at` jobs** (`/var/spool/cron/atjobs`, `/var/spool/at`): queued scripts that run as root later. 4. **Other root-run hooks:** `/etc/logrotate.d` (`postrotate` runs as root), udev `RUN+=` rules (`/etc/udev/rules.d`), NetworkManager dispatcher scripts, `/etc/network/if-*.d`, apt/dpkg hooks (`/etc/apt/apt.conf.d` `DPkg::Post-Invoke`), `/etc/ld.so.preload` and `/etc/ld.so.conf.d`, `/etc/pam.d`. If the account can write any of these, or a script they name, root runs its code. 5. **Other root daemon sockets:** `/run/podman/podman.sock`, `/var/lib/incus/unix.socket`, `/var/snap/lxd/common/lxd/unix.socket`, `/run/libvirt/libvirt-sock`. These are reachable through ACLs or custom groups; today only the docker and containerd paths are probed. 6. **Non-root accounts' scheduled work** (their crontabs and system units running as them) whose scripts the revoked account can write. That isn't root, but it lets the person write as another host account later. 7. **`.path` units** whose watched path the account can write. They trigger root services when that path changes. The service's own inputs are checked; the trigger is not reported. None of these were confirmed live in this review. They come from reading the code against the checks it names. No owner decision is requested here; prioritise after #355 merges.

kayg referenced this issue

2026-11-08 22:45:16 +00:00

Gate flakes, round 2 #355

kayg referenced this issue

2026-11-08 22:51:42 +00:00

Gate flakes, round 2 #355

kayg referenced this issue

2026-11-08 23:11:54 +00:00

Gate flakes, round 2 #355