admin
3f382bf762
From AUDIT-blast-radius-hostroot-localapi-2026-07-02.md. Each fix ships with a non-hollow test + a companion red-proof (shown failing on the pre-fix impl). Sudoers install-source grants became globs — deploy the sudoers drop-in with the binary. A1 (stale-lock pool-membership) deliberately excluded (spike). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
95 lines
4.4 KiB
Bash
95 lines
4.4 KiB
Bash
#!/bin/bash
|
|
#===============================================================================
|
|
# felhom-mkfs-guarded — the ONLY mkfs path the felhom-agent sudoers permits (Impl-1 Part B,
|
|
# SPIKE-drive-enrollment-2026-07-01 §SQ3). Defense-in-depth BELOW the agent: even a buggy or
|
|
# compromised agent cannot mkfs a catastrophic target through this — it re-checks, as root, the
|
|
# cheap catastrophic cases (OS/system disk, LVM physical volume, a foreign mount, a read-only
|
|
# device, and any LVM/ZFS/mdraid/LUKS/swap member signature — audit D1) and refuses.
|
|
#
|
|
# The agent's full unclaimed-disk filter (internal/storage/claim.go) is the PRIMARY guard; this
|
|
# wrapper is a deliberately minimal, auditable second gate. It is NOT the place for the full filter.
|
|
#
|
|
# Usage: felhom-mkfs-guarded <device> <fstype:ext4|xfs>
|
|
#===============================================================================
|
|
set -euo pipefail
|
|
|
|
die() { echo "felhom-mkfs-guarded: REFUSED: $*" >&2; exit 1; }
|
|
|
|
dev="${1:-}"; fstype="${2:-}"
|
|
[[ -n "$dev" && -n "$fstype" ]] || die "usage: felhom-mkfs-guarded <device> <fstype>"
|
|
|
|
# The device must be a REAL block-device node under /dev — no symlink (e.g. /dev/disk/by-*), no traversal.
|
|
[[ "$dev" == /dev/* ]] || die "device must be under /dev ($dev)"
|
|
[[ "$dev" != *..* ]] || die "path traversal ($dev)"
|
|
[[ -b "$dev" ]] || die "not a block device ($dev)"
|
|
[[ ! -L "$dev" ]] || die "device must be a real node, not a symlink ($dev)"
|
|
|
|
# Whole-disk of the target (a partition's parent, else the disk itself).
|
|
pk="$(lsblk -ndo PKNAME "$dev" 2>/dev/null || true)"
|
|
whole="$dev"; [[ -n "$pk" ]] && whole="/dev/$pk"
|
|
|
|
# 1) OS/system disk — does the target's whole-disk back /, /boot or /boot/efi?
|
|
while read -r src mnt _rest; do
|
|
case "$mnt" in
|
|
/|/boot|/boot/efi)
|
|
spk="$(lsblk -ndo PKNAME "$src" 2>/dev/null || true)"
|
|
swhole="$src"; [[ -n "$spk" ]] && swhole="/dev/$spk"
|
|
[[ "$swhole" == "$whole" || "$src" == "$dev" || "$src" == "$whole" ]] && die "system/OS disk ($dev backs $mnt)"
|
|
;;
|
|
esac
|
|
done < /proc/mounts
|
|
|
|
# 2) LVM physical volume anywhere on the target disk or its partitions. pvs is resolved by ABSOLUTE
|
|
# path (audit D1: `command -v pvs` silently skipped this check when pvs wasn't on the caller's
|
|
# PATH); if neither candidate exists, check 5's LVM2_member FSTYPE loop still catches a PV
|
|
# independently — pvs-absent never silently drops LVM detection.
|
|
pvsbin=""
|
|
for c in /usr/sbin/pvs /sbin/pvs; do
|
|
[[ -x "$c" ]] && { pvsbin="$c"; break; }
|
|
done
|
|
if [[ -n "$pvsbin" ]]; then
|
|
while read -r pv; do
|
|
pv="${pv//[[:space:]]/}"; [[ -z "$pv" ]] && continue
|
|
pvpk="$(lsblk -ndo PKNAME "$pv" 2>/dev/null || true)"
|
|
pvwhole="$pv"; [[ -n "$pvpk" ]] && pvwhole="/dev/$pvpk"
|
|
[[ "$pvwhole" == "$whole" ]] && die "device holds an LVM physical volume ($pv)"
|
|
done < <("$pvsbin" --noheadings -o pv_name 2>/dev/null || true)
|
|
fi
|
|
|
|
# 3) mounted OUTSIDE Felhom's own drive area = a live foreign filesystem → catastrophic. Mounts under
|
|
# /mnt/felhom-drives are our own drives (the agent detaches before a re-init) → allowed.
|
|
while read -r mp; do
|
|
[[ -z "$mp" ]] && continue
|
|
case "$mp" in
|
|
/mnt/felhom-drives|/mnt/felhom-drives/*) : ;;
|
|
*) die "device (or a partition) is mounted at $mp ($dev)" ;;
|
|
esac
|
|
done < <(lsblk -nro MOUNTPOINT "$whole" 2>/dev/null || true)
|
|
|
|
# 4) read-only device (audit D1): a device the kernel marks RO is never a formattable data disk.
|
|
wbase="${whole#/dev/}"
|
|
rof="/sys/block/$wbase/ro"
|
|
if [[ -r "$rof" ]]; then
|
|
ro="$(cat "$rof" 2>/dev/null || true)"
|
|
[[ "$ro" == "1" ]] && die "read-only device ($whole)"
|
|
fi
|
|
|
|
# 5) member/active FSTYPEs anywhere on the target disk or its partitions (audit D1). Mirrors
|
|
# claim.go memberFSTypes exactly: a member of LVM/ZFS/mdraid/LUKS or active-swap signature is
|
|
# always a claim, never a plain formattable data disk. This also independently catches an LVM PV
|
|
# when pvs is not installed (check 2's belt-and-suspenders).
|
|
while read -r fst; do
|
|
[[ -z "$fst" ]] && continue
|
|
case "$fst" in
|
|
LVM2_member|zfs_member|linux_raid_member|crypto_LUKS|swap)
|
|
die "device holds a $fst signature ($whole)" ;;
|
|
esac
|
|
done < <(lsblk -nro FSTYPE "$whole" 2>/dev/null || true)
|
|
|
|
# Passed the catastrophic checks → format. exec so the mkfs exit status is the wrapper's.
|
|
case "$fstype" in
|
|
ext4) exec /usr/sbin/mkfs.ext4 -F "$dev" ;;
|
|
xfs) exec /usr/sbin/mkfs.xfs -f "$dev" ;;
|
|
*) die "unsupported fstype ($fstype)" ;;
|
|
esac
|