capability: agent privileged-capability self-probe (manifest + build-test + runtime snapshot) v0.44.0

New internal/capability: Manifest of required sudo -n grants + Prober that LISTS each
via 'sudo -n -l' (never executes) + binary-exists check → ok/degraded snapshot on the hub
report. Build-time test asserts manifest⊆sudoers (red-proof: dropping lxc-info FAILs the
gate). Startup logs N/N ok + ERROR per degraded. Serve-degraded; no allowlist change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

This commit is contained in:

authentik Default Admin

2026-06-29 18:43:49 +02:00

parent 19582046ba

commit 25024d9dda

10 changed files with 584 additions and 11 deletions

									
										internal/hub/testdata/host-report.golden.json
									
Vendored

		+1
		
												View File
												
				@@ -132,6 +132,7 @@

				  ],

				  "cloudflared": { "status": "active" },

				  "audit_tail": [],

				  "capabilities": [],

				  "dr_recipe": {

				    "recipe_version": 1,

				    "guests": [