4 Commits

Include renames

Author	SHA1	Message	Date
admin	03ab121b25	v0.329.0 (review): an app named like another app's appdata folder gets no root; USERDATA_PATH is always derived, never the app's env ... Security review of 2fe6341 (same night, before any release). Both red-proofed.	2026-10-17 23:22:54 +02:00
admin	99f9117296	v0.328.0 (unreleased): live finding on 9201 (rc.4) — roots resolved through their nearest existing ancestor; no symlink resolve for the placeholder check ... Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 16:52:09 +02:00
admin	24d937d6e4	v0.328.0 (unreleased): the security review's four findings — the entry is bound to its image and start; symlinks out of a root; the missed classes; roots only under the drive namespace or system data ... Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 16:42:18 +02:00
admin	6d90374f63	v0.328.0: the catalog allow-list — the box refuses container rights a template asks for and the box does not give (R-971, D2 = A) ... internal/privpolicy checks the RENDERED compose (privileged, cap_add, devices, host namespaces, security_opt, sysctls, volumes_from, build/include/extends, env_file/config files outside the stack dir, aliasing named volumes, binds outside the box's data roots, the Docker socket, propagation, ${VAR} in a privileged key) against an allow-list compiled into the controller (one entry: homepage's read-only socket). Asked before every compose write: the 15-minute sync, the guarded update/ladder step, the install, both settings changes, both restores (before the stop). A refusal writes nothing, keeps the app on its last good compose, raises the operator-only event app_definition_refused once per definition and puts one line on the app page. The sync never copies a template named like a controller infra stack. Structural guard TestAllowList_IsWiredIntoEveryComposeWriter. Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 16:34:12 +02:00