Let dejima-guard collect from this devbox, without giving it a shell #22
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: dejima/dejima-devbox-hardener#22
Reference in New Issue
Block a user
Summary generated by LLM agent
Holds the v5 guard-access work, and now a prose pass ahead of going public.
Em-dashes
House style across the organisation, and the punctuation most reliably read as machine-written. The shell in this repository already used
-throughout; only the prose disagreed with it. 126 of them, replaced by what each one stood in for rather than by one substitute: a colon where an explanation follows, a comma before a conjunction, brackets where a pair was fencing a parenthetical.The blind pass corrupted the firewall table
Worth stating plainly. The rule tables use an em-dash for a cell that does not apply, so
| - | - |became|: |: |in the table documenting the primary control, in bothproxmox/README.mdand the v2 upgrade note. Nothing about the rendered page looks wrong enough to catch on a read-through.Repaired to ASCII hyphens, and there is now a test for table cells holding punctuation and nothing else.
Two smaller artefacts from the same pass, both at line wraps where a line-local rule cannot see the conjunction on the next line: a colon before "and", and a dash opening a line becoming a colon opening one.
The em-dash test builds the character from its bytes rather than writing it, since a check containing the thing it looks for reports itself, and the only way to make that pass is to exempt the file the check lives in.
Also in this branch, from earlier rounds
sha256sumescapes a filename containing a backslash or a newline by prefixing the line with a backslash, which broke theFILEtag, so those lines went out untagged. A watcher counts changes by their tag, so a file with such a name could change without appearing in the count the alert carries. A filename is attacker-chosen on a box under suspicion, which makes it a gap somebody could pick rather than stumble into.And a duplicate-paragraph test, after section 3 of the node runbook was found opening with six verbatim duplicated lines, having survived two prose passes.
Tested: 180 passing. Both new prose guards were run against a reintroduced em-dash and a corrupted cell and fail on each.
dejima-guard watches this box from a machine that is not this box, and it pulls - it reaches in over SSH and the devbox never reaches out. That inversion is what lets a guard report on a devbox that has been taken, so the work here is one inbound pinhole and deliberately no outbound rule at all. v5, optional, and node-side except for the key. THE FORCED COMMAND I DOCUMENTED DID NOT WORK. It was `command="dejima-devbox-audit ${SSH_ORIGINAL_COMMAND##* }"`, taking the last word of whatever arrived - so `drift --state` became `--state`, which is not a subcommand. Drift collection would have failed on every cycle while reach kept working, leaving a box that looked watched with half of it unwatched. Found by testing the line rather than by reading it. bin/dejima-guard-shell replaces it: a whitelist of the two exact commands the guard sends. Whitelisting says what may run; sanitising tries to describe what may not, and gets it wrong quietly. AND IT DEFAULTED TO ROOT, on a machine this project's own runbook builds without a root password. The guard connects as an ordinary account and elevates through sudo for those two invocations, with a sudoers line that names both rather than the program - because NOPASSWD on the program alone would also permit `drift --accept`, and a key that can re-baseline can tell this box that whatever an intruder left on it is normal. The runbook has four test commands: two that must work and two that must print `refused`. A restriction nobody tried is a restriction nobody has, and this one is what stands between a key taken off the guard and a shell here. `bats test/` 171 passing, 10 new. Renumbering the guest runbook to fit §7 in broke two anchors in the threat model, which links.bats caught.