v0.328.0 (unreleased): the security review's four findings — the entry is bound to its image and start; symlinks out of a root; the missed classes; roots only under the drive namespace or system data

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-17 16:42:18 +02:00
parent 6d90374f63
commit 24d937d6e4
5 changed files with 202 additions and 12 deletions
@@ -1,11 +1,12 @@
 {
  "version": 1,
-  "note": "R-971 (operator decision D2 = A, 2026-10-17). The box's catalog allow-list, compiled into the controller. Each entry allows ONE exact setting for ONE service of ONE app; a changed setting is a different one and is refused. The catalog's scripts/privilege-allowlist.json is a byte-identical copy for its CI gate. Survey: felhom.eu documentation/audits/agent-allowlist-rotation-2026-10-17/P2/survey.md",
+  "note": "R-971 (operator decision D2 = A, 2026-10-17). The box's catalog allow-list, compiled into the controller. Each entry allows ONE exact setting for ONE service of ONE app, only while that service runs the entry's image repository with the image's own entrypoint and command; a changed setting is a different one and is refused. The catalog's scripts/privilege-allowlist.json is a byte-identical copy for its CI gate. Survey: felhom.eu documentation/audits/agent-allowlist-rotation-2026-10-17/P2/survey.md",
  "entries": [
    {
      "app": "homepage",
      "service": "homepage",
      "setting": "bind /var/run/docker.sock -> /var/run/docker.sock ro",
+      "image": "ghcr.io/gethomepage/homepage",
      "why": "the Docker widget and the docker service discovery list the household's containers and their state",
      "doc": "https://gethomepage.dev/configs/docker/"
    }