Repository navigation
fix(exec_policy): judge every hop of a symlink chain (Ubuntu 26.04 rm -> gnurm) - #10
Merged
Merged
Conversation
…ame> On Ubuntu 26.04 /usr/bin/rm -> gnurm. classify() judged only the final target name; "gnurm" is unknown and lives in a system dir, so it was treated as a distribution alternative and ignored, and ./ls -> /usr/bin/rm was classified by its link name: an agent-origin `./ls -rf x` was ALLOWed. Now every hop of the chain is judged (ls -> rm -> gnurm), and a gnu<name> hop is also judged as <name>. Two portable tests build the chain under a temp dir patched into _SYSTEM_DIRS; all three link tests fail without the fix. Also: the GitHubBridge auth test asserted the account name "osiris-dnalang"; it now checks only that an account is reported (the gh account changed to quantum-osiris on 2026-11-09). Drops an unused MagicMock import. Full suite: 1796 passed, 13 skipped, 0 failed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security fix
On Ubuntu 26.04,
/usr/bin/rmis a symlink tognurm.classify()judged a program only by the final file a link resolves to.gnurmis not a known name and sits in a system directory, so the policy treated it as a harmless distribution alternative and skipped it. The command was then classified by the link's name instead.Result before this fix: a symlink
./ls -> /usr/bin/rmlet an agent-origin./ls -rf xthrough as ALLOW. Expected: DENY / MUTATE.Change
ls -> rm -> gnurm), not only the last one.gnu<name>hop is also judged as<name>.which -> which.debianutils) is not treated as a risk.Tests
_SYSTEM_DIRS, so they don't depend on the host OS.TestGitHubBridge::test_auth_status_inspectionno longer hardcodesosiris-dnalang. It now checks only thatghreports an account; the account becamequantum-osirison 2026-11-09.ruff check --select E,F,Won the changed files: clean.Together with #9, this clears the two failures that were already on
main.🤖 Generated with Claude Code