[codex] OM-SEC-23: Keep debug collectors outside dmesg authorization - #9477
[codex] OM-SEC-23: Keep debug collectors outside dmesg authorization#9477AFOliveira wants to merge 12 commits into
Conversation
bd584da to
bfb7655
Compare
|
Rebuilt after the review-wide complexity audit. The PR is reduced from 857 changed lines across debug staging, private installer-log upload, and dmesg authorization to 367 lines across one production command, the shared helper, its one-line policy documentation, and a focused regression. Relative to prerequisite #8370, the independent production change is 47 additions / 17 deletions in Validated at |
There was a problem hiding this comment.
🟡 Changes recommended
The helper is missing from settings-only packaging, and the test can incorrectly skip valid subordinate-GID environments.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR isolates dmesg authorization from user-resolved diagnostic collectors.
Changes:
- Adds fail-closed Bash and sudo helpers.
- Uses
sudo -Nwith timestamp revocation arounddmesg. - Adds a namespace-based security regression test.
File summaries
| File | Description |
|---|---|
AGENTS.md |
Documents the privileged-Bash exception. |
bin/omarchy-debug |
Enforces the authorization boundary. |
bin/omarchy-security-functions |
Adds shared security helpers. |
test/shell.d/debug-sudo-security-test.sh |
Models credential-reuse attacks. |
Review details
- Files reviewed: 2/4 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| outer_uid=$(id -u) | ||
| outer_gid=$(id -g) | ||
| subuid=$(awk -F: -v user="$(id -un)" '$1 == user { print $2; exit }' /etc/subuid) | ||
| subgid=$(awk -F: -v group="$(id -gn)" '$1 == group { print $2; exit }' /etc/subgid) |
There was a problem hiding this comment.
🟡 Changes recommended
Package installation remains wired to the now-unlaunchable collector, and capture errors can incorrectly report success.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 4/7 changed files
- Comments generated: 3
- Review effort level: Balanced
| if (received < 0) { | ||
| kill(child, SIGKILL); | ||
| break; | ||
| } |
| if (write_all(output_fd, buffer, (size_t)received)) { | ||
| kill(child, SIGKILL); | ||
| break; | ||
| } |
| exec unshare --user --mount \ | ||
| --map-users "0:$outer_uid:1" --map-users "1:$subuid:65536" \ | ||
| --map-groups "0:$outer_gid:1" --map-groups "1:$subgid:65536" \ | ||
| env OMARCHY_DEBUG_SUDO_SECURITY_NS=1 bash "$0" |
…dex/portfolio-9457-20260907
Moves OM-SEC-23's authorization boundary into a root-owned, non-setuid static PIE launcher. It opens and validates the fixed collector, clears existing sudo authorization, captures only fixed
sudo -N -- /usr/bin/dmesginto bounded sealed memory, revokes again, then starts the unprivileged Bash collector with a sanitized environment. Local capture read/write failures remain failures even if the child already exited successfully.The paired packaging change is omarchy-pkgs#285, built on omarchy-pkgs#257. Settings owns the ELF
/usr/bin/omarchy-debug, fixed/usr/lib/omarchy/omarchy-debug-collector, and CLI metadata sidecar. The branch integrates #9457's exact shared foundation and current Quattro. #8370 remains overlapping work on private diagnostic staging and must be reconciled when its final changes land.At
f57934c1, independent Daybreak review accepts the source correction. The unprivileged C fixture covers exact output, full-destination failure, read error, interrupted read, overflow and child reaping; CLI112, syntax and whitespace checks pass. The namespace test now probes its exact requested capabilities before running. The audit did not rerun its historical setuid/mutation model.All four runtime/settings package variants built from the exact candidate source. The matched stable-named 4.0.2-3 pair was installed in the disposable x86_64 Omarchy VM. Installed ownership, static PIE properties, fixed collector hashes, sidecar help/JSON routing and private mode-0600 logs passed.
--no-sudo --printcompleted with zero password prompts; normal--printcompleted with exactly one and left authorization revoked. The installed launcher and collector completed successfully.Remains draft for coordinated source/package release: the stable recipe's declared upstream pin predates this source and must advance after it lands. Current builds used the explicit candidate-source override. Fresh ISO and aarch64 remain unvalidated; these results do not claim those release configurations.