felhom.eu/documentation/audits/night-burndown-2026-10-06/design-R-861.md

# R-861 — the three sudoers leftovers — design proposal (burn-down night 2026-10-06, no code)

Baselines read: felhom-agent `74b5eae`, felhom.eu `8e2dc204`. Architecture: `03-host-agent.md` §3.1 (the group table)
and §11, `11-os-updates.md` §5.4.2 (the config bundle), `09` §3 decision 122. Read only; nothing ran on a box.

## 1. The problem
After agent v0.146.1 a compromised agent PROCESS (user `felhom-agent`) no longer becomes host root: measured 2026-10-05,
29 attack lines refused, `sudo -l` 93/93 on both demo boxes (`audits/hub-safety-2026-10-05/partF/`). Three paths were
left open on purpose and named in `03` §3.1. The row asks the operator: accept them, or close them before the first
paying customer? The question for each is: **what does an attacker who already owns the agent process gain through it,
beyond what the agent already has?**

What the agent already has (the baseline): its Proxmox token holds `VM.Backup`, `VM.Allocate`, `VM.Config.*`,
`VM.PowerMgmt`, `Pool.Allocate` on `/pool/felhom` (`felhom.eu/scripts/felhom-host-install.sh:309`). So it can already
back up a customer guest and restore it into a scratch guest (the restore-test does exactly that), stop and start felhom
guests, and it writes the guest's `bootstrap.json` itself. **The household's data is already in its reach, offline.**

## 2. What the code does today (read in source)

**(a) The controller image ref.** `FELHOM_CONTROLLERSWAP` allows `pct exec <vmid> -- tee /etc/felhom-controller-image`
(`felhom-agent/configs/felhom-agent.sudoers:122`). The ref goes in on STDIN (`internal/localapi/controllerswap.go:150`).
The regex `controllerImageRe` (`controllerswap.go:36`) is the agent's OWN check — a compromised agent skips it, and sudo
cannot see stdin. The guest's bootstrap unit then runs `docker run … "$IMAGE"` with the docker socket, the read-only
bootstrap dir and `/mnt` (`configs/build-golden.sh:316,355-362`).
**Correction to `03` §3.1:** the table says *"a chosen (pinned-registry) image ref"*. That is not true: only the
`docker image inspect` line is pinned (`sudoers:119`); the `tee` content is free, so the bootstrap pulls and runs **any
image from any registry**. Gain over the baseline: a LIVE foothold in the guest with the docker socket (guest root, the
household's running apps and its LAN), and it survives agent restarts until the next swap. Not host root.

**(b) The felhom-op SSH key.** `felhom-priv-apply sshd-key` installs one plain key line (no `command=`/`from=`;
`configs/felhom-priv-apply:60-61`) from a file the agent staged; the key itself comes from the hub, unsigned. A
compromised agent can therefore put its own key on `felhom-op`. `felhom-op`'s sudo (`configs/felhom-op.sudoers`) is
scoped: restart wg/agent/sshd, `pct list`, and `pct start|stop|unlock [0-9]*` — **on any guest of the host**, not only
the felhom pool. Gain over the baseline: power control of NON-felhom guests on a BYO host (the household's own other
VMs), and an interactive login. Not host root. (Side note: these `pct` lines still use the `*` glob, which matches
spaces — the R-861 shape 1; no harmful `pct start/stop` option is known, so this is hygiene, not a hole.)

**(c) The escrow ceremony.** The root child (`FELHOM_ESCROW`, `sudoers:283-284`) returns the recovery code R on the
agent's stdout pipe (`internal/localapi/escrow_ceremony.go:19-29,93`); the agent holds R in memory for one claim
(`:140-147`). The agent's own hub key may read this box's escrow blob (`hub/internal/api/handler.go:252,1357-1372`,
self-scoped). So a compromised agent can learn R, fetch the blob and unwrap this box's PBS encryption key (and the
identity bundle). Gain over the baseline: **off-box** decryption of this box's off-site archives, which lasts after the
compromise is cleaned up, until the key is rotated. One box only; not root.

## 3. Options

**(a)**
- **A1. A checking wrapper verb.** `felhom-priv-apply controller-image <vmid>`: as root, read stdin, require
  `^gitea\.dooplex\.hu/admin/felhom-controller:[0-9]+\.[0-9]+\.[0-9]+$`, then write the guest file. The sudoers `tee` line
  is removed. Same mechanism as decision 122 (b); delivered by the signed config bundle. Cost: ~1–2 h (one verb, its
  Python tests, the Go call path, `TestManifestCoveredBySudoers`, the capability probe). What can go wrong: the old
  agent binary still calls `tee` → the bundle must follow the agent update (the usual order). Leaves: a chosen OLD
  controller version from our registry (a downgrade) — still possible.
- **A2. Check in the guest.** The bootstrap script refuses a ref outside the pattern. Cost: a golden change, and
  existing guests keep the old script until re-baked — slow to reach the fleet.
- **A3. Accept.** Write the corrected sentence in `03` §3.1.

**(b)**
- **B1. Sign the key.** The operator signs the felhom-op key with the operator key; `felhom-os-apply` verifies as root.
  Cost: medium; every key rotation needs the operator's offline signature.
- **B2. Narrow felhom-op's sudo** to anchored regexes (`^start [0-9]+$` …) — hygiene only; it does not stop the key swap.
  Cost: ~30 min, rides the bundle.
- **B3. Accept** (felhom-op is not root; the gain is power control of guests).

**(c)**
- **C1. R bypasses the agent.** The root child writes R straight into the guest (to the controller), so the agent never
  sees it. Cost: a ceremony redesign across agent and controller; touches the escrow promise to the household.
- **C2. Accept** — the ceremony is designed so the box handles K once; the residual is "a compromised agent can read
  this one box's backups off-site", which `03` §3.1 already names.

## 4. The pick — PROPOSAL for the operator, not a decision
- **(a) A1, before the first paying customer.** It is the only one of the three that gives a live, persistent foothold
  next to the household's running apps, and the fix uses a mechanism already built and measured. Fix the `03` sentence
  in the same commit.
- **(b) B3 now, B2 as hygiene** with the next bundle; B1 later if the OOB door is ever opened wider.
- **(c) C2.** C1 changes an escrow promise and is a redesign — not before the first customer.

## 5. First slice and its proof (for A1)
- Build: verb `controller-image` in `configs/felhom-priv-apply` (stdin ≤ 256 bytes, the regex, a numeric vmid, then
  `pct exec <vmid> -- tee` as root); sudoers: remove `tee /etc/felhom-controller-image$`, add
  `/usr/local/sbin/felhom-priv-apply ^controller-image [0-9]+$`; `controllerswap.go:150` calls the verb.
- Red test first: `configs/test_felhom_priv_apply.py` — `controller-image 9201` with stdin
  `docker.io/library/alpine:latest` must exit 3; with `gitea.dooplex.hu/admin/felhom-controller:0.301.0` exit 0. And
  `TestSudoersRefusesTheR861Injections` gains `pct exec 9201 -- tee /etc/felhom-controller-image` as a REFUSED line —
  it fails on today's sudoers.
- Live proof on scratch 9202 after a bundle there (not tonight): `sudo -l -U felhom-agent` lists no `tee`; a managed
  controller update still swaps (positive observable: the new controller version in `docker ps` AND the hub's host
  report — two channels); a hand-fed `alpine` ref is refused (journal tag `felhom-priv-apply`).

## 6. Open questions for the operator
1. **(a)** Close the free image ref before the first paying customer (A1, ~1–2 h, ships with a bundle)? If you do
   nothing: a compromised agent can run any container next to the household's apps, with the docker socket.
2. **(b)+(c)** Accept both for the first customers (felhom-op is not root; the escrow residual is one box's off-site
   backups)? If you do nothing: they stay open, named in `03` §3.1, as today.