admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

REPORT: correct the F-LEAK story — the band ACL is consumed by use; v0.110.0 is the durable fix

Browse Source
This commit is contained in:
authentik Default Admin
2026-07-28 11:35:05 +02:00
parent 5ffdcecb2d
commit b97623045b
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
REPORT-freboot-fleak-fobs.md
+10 -2
View File
@@ -4,7 +4,15 @@ Scope in this repo: **`scripts/felhom-host-install.sh` v1.20.0 → v1.21.0** (wh
*actual* fix lives), plus the Campaign 8 audit doc and `OPEN-ITEMS.md`. Written as
`REPORT-freboot-fleak-fobs.md` so the shared `REPORT.md` is not clobbered.
Code companions: `felhom-agent` v0.106.0 → **v0.109.0**, `felhom-controller` v0.179.0 → **v0.180.0**.
Code companions: `felhom-agent` v0.106.0 → **v0.110.0**, `felhom-controller` v0.179.0 → **v0.180.0**.
**Correction to this repo's part of the story:** v1.21.0's band-scoped ACL is *not* the final F-LEAK
fix. It works, but only **once per slot** — PVE's destroy path calls
`AccessControl::remove_vm_access($vmid)` (`API2/LXC.pm:906`), which deletes every ACL at `/vms/<vmid>`
(`AccessControl.pm:1898`), so **the grant is consumed by the operation it authorises**. Found by counting
ACL rows after the first successful teardown (`/vms/990000` → 0 grants), not by reasoning about it. The
durable fix is agent **v0.110.0**'s band-scoped fenced destroy; v1.21.0 remains valuable because it makes
the common case need no privileged call, and it is now the *first* of two layers rather than the only one.
## Baselines (reconfirmed, not copied)
`felhom.eu d0cec9d`, `felhom-agent af1c21a`, `felhom-controller fb91c8d`, all clean. Agent `0.106.0`
@@ -47,7 +55,7 @@ Two supporting changes, both load-bearing rather than tidy-up:
- **`step_verify` asserts the band grants.** A missing one is otherwise invisible until a restore-test
*fails*, which is precisely the case that leaked a guest in the first place.
### Why this is not a widening — proven live, at the seam the defect lives in
### Why the grant is still not a widening — proven live, at the seam the defect lives in
A real PBS restore to `990000` **without `--pool`** reproduced the exact stranded state
(`990000 stopped`; `felhom pool members: [9201]`; `990000 in pool: False`). Then, with the agent's own