admin
4691aa1a35
Phase A passed every gate on a fresh box built from the PUBLISHED ISO 1.26.1: install, claim, two drives enrolled through the real endpoints with the backup target healthy, four apps spanning both sides of D5's secret split, and a working discriminator across all four. Isolation gate: both denials captured, each with a positive control. The PBS control FAILED first — four clean-looking 403s were worthless because the token was denied on its own datastore too (PBS token privilege separation). Fixed and re-run; the denials stand. R-156 (new, register grepped): papra's data is neither persisted nor backed up, and it reports healthy. The template mounts papra_data:/app/data; the app writes /app/app-data/db/db.sqlite. Volume empty and root-owned against a -rootless image, real DB in the container writable layer, healthcheck only probes the HTTP port. Its Tier-1/2 backup is real, verifiable and contains nothing. Not fixed. Tier 3 could not be isolated so it was not run: offsite hard-requires the DR tier (configs.go:1300) and the DR tier only provisions on ep0 (per-endpoint allocation deferred, hub/README.md:260). Both are recorded deliberate positions, so no R-n minted. The campaign touched neither ep0 nor the Storage Box. Phase B did not start. Phase A was budgeted at ~1h and took ~5.5h (1.26.1 is a public release image with no auto-install path, so the install was a blind screendump+sendkey walk). That left the runner — which judges eleven invariants and fires destructive atoms unattended — to be written at 04:00 with ~3h of night left. Stopped on the brief's own fence: a rig producing false negatives is worse than no rig. The rig is built and idle; teardown is OWED and itemised, including hub customer c10-soak (disposition: DELETE).
54 lines
2.7 KiB
Plaintext
54 lines
2.7 KiB
Plaintext
# restic/Storage-Box isolation proof — subaccount u629488-sub4 (home felhom-campaign10)
|
|
# box 611714 storage-box-pool-1 · server u629488.your-storagebox.de · 2026-07-31T20:15:55Z
|
|
# Production subaccounts on the SAME box: sub1=felhom-demo-felhom sub2=felhom-peti-felhom sub3=felhom-demo-hp
|
|
# Password never echoed; supplied to sshpass via env.
|
|
|
|
## POSITIVE CONTROL — sub4 in its OWN home (must SUCCEED)
|
|
$ sftp> pwd ; ls -a ; put canary ; ls
|
|
Warning: Permanently added '[u629488.your-storagebox.de]:23' (ED25519) to the list of known hosts.
|
|
Connected to u629488.your-storagebox.de.
|
|
sftp> pwd
|
|
Remote working directory: /home
|
|
sftp> ls -a
|
|
. ..
|
|
|
|
## DENIAL 1 — reach Peti's REAL customer repo path from sub4
|
|
$ sftp> cd /home/felhom-peti-felhom / cd ../felhom-peti-felhom / ls /felhom-peti-felhom
|
|
Connected to u629488.your-storagebox.de.
|
|
sftp> cd /home/felhom-peti-felhom
|
|
stat remote: No such file or directory
|
|
sftp> cd ../felhom-peti-felhom
|
|
stat remote: No such file or directory
|
|
sftp> ls /felhom-peti-felhom
|
|
Can't ls: "/felhom-peti-felhom" not found
|
|
sftp> ls ..
|
|
remote readdir("/home/../"): Permission denied
|
|
|
|
## DENIAL 2 — reach demo-felhom's and demo-hp's production repo paths
|
|
Connected to u629488.your-storagebox.de.
|
|
sftp> cd /home/felhom-demo-felhom
|
|
stat remote: No such file or directory
|
|
sftp> ls /felhom-demo-felhom
|
|
Can't ls: "/felhom-demo-felhom" not found
|
|
sftp> cd /home/felhom-demo-hp
|
|
stat remote: No such file or directory
|
|
sftp> ls /felhom-demo-hp
|
|
Can't ls: "/felhom-demo-hp" not found
|
|
|
|
## POSITIVE CONTROL (STRENGTHENED) — sub4 must be able to WRITE and READ BACK in its own home,
|
|
## proving the credential is fully functional and the denials above are AUTHORIZATION, not a dud login.
|
|
Connected to u629488.your-storagebox.de.
|
|
sftp> put /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0d68ad3e-5c39-4852-8e38-9c029dff2562/scratchpad/c10-canary.txt c10-canary.txt
|
|
Uploading /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0d68ad3e-5c39-4852-8e38-9c029dff2562/scratchpad/c10-canary.txt to /home/c10-canary.txt
|
|
sftp> ls -l
|
|
-rw-rw-r-- ? u629488-sub4 1059 56 Jul 31 22:16 c10-canary.txt
|
|
sftp> get c10-canary.txt /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0d68ad3e-5c39-4852-8e38-9c029dff2562/scratchpad/c10-canary-readback.txt
|
|
Fetching /home/c10-canary.txt to /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0d68ad3e-5c39-4852-8e38-9c029dff2562/scratchpad/c10-canary-readback.txt
|
|
sftp> rm c10-canary.txt
|
|
Removing /home/c10-canary.txt
|
|
sftp> ls -l
|
|
readback content: campaign10 write-capability canary 2026-07-31T20:16:23Z
|
|
|
|
## VERDICT: write+read succeed in own home; every production path is outside the chroot
|
|
## ('No such file or directory') and the parent directory is an explicit 'Permission denied'.
|