Repository navigation
feat: a signed plane refuses a roster its own account may write - #96
Merged
Merged
Conversation
Under the signed authority the plane now refuses to start when its own account can write trust.roster or a directory on its path, as it already does for the configuration, the root key, the pause file, the route, the stop list and the run records. A test classifies every file key the signed authority reads as checked or plane-writable, so a new one cannot be missed. The operator commands that judge with --roster say on standard error which roster they judged, its serial and its expiry, before they sign or list. Doctor's signed route and stop list reads get a test, and stops init --carry runs as a command in a test. Signed-off-by: Konrad Karauda <konrad@karauda.com>
…he seam The plane's account still writes trust.floor_dir: raising the roster floor withholds a newer roster until the held one expires. The pages now say so, and that what the placement check adds is that the plane's account can no longer put an older roster in place. Doctor's signed stop list read is a method with its own test run with the plane-owned switch off, so a doctor that takes a list the plane's own account owns fails a test. react's guard against the plane's account is a variable, so a test on one account reaches the roster line it prints. The classification test also runs over a minimal signed tree, so a check that depends on another key being set fails it. Signed-off-by: Konrad Karauda <konrad@karauda.com>
Signed-off-by: Konrad Karauda <konrad@karauda.com>
🚀 Deploying Preview to Cloudflare 🚀Preview Deployments by commit
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Under
approvals.authority: signeda plane now refuses to start when its own account may write thetrust.rosterfile or a directory on its path;doctorfails itstrustcheck the same way. Before, that account could put an older roster back. Operator commands also say which roster they judged with.Roster placement (
cmd/guardana-gateway):trust.rosterjoins the configuration file, the root key, the pause file, the route, the stops and the run records incheckSignedStart.gatewayconfig.Fields(). Each key is either checked at a signed start or named with the reason it is not. It runs over a full signed tree and over the minimal one, so a check that depends on another key being set fails.Operator commands (
cmd/guardana-control):pause,stops,runs open,runs close,superviseandreactprint, on standard error and before they sign or list:judged with roster <id> serial <n>, expires <time>. The expiry comes from the document. Their judgement has no roster floor; the plane's is the one that counts.runs open --keyreads the roster and the key before it makes an empty directory a signed layout.Stated limit (ADR-0071, ADR-0073, threat model, status): the plane's account still writes
trust.floor_dir. By raising the roster floor it can withhold a newer roster until the held one expires. What this change adds is that it can no longer put an older roster in place.Pages: ADR-0071, 0073 and 0076 amended, glossary, threat model, run-the-gateway, status, CHANGELOG (Breaking).
Verified:
pause.fileis set; doctor taking a list the plane's account owns; the judged line missing, off by one serial, or with its expiry read from the clock; the layout written before the roster is read; react's guard against the plane's account turned into a no-op; react not printing the line.internal/trust,internal/console,internal/core/approval,internal/metrics,internal/docscheckandinternal/core.make vet,check-imports,check-brand,check-sizes, golangci-lint.Not verified or not covered:
trust.rosterpath that is not clean (a link followed by..) is judged through the link and read cleaned. The plane's account cannot supply such a path. This is recorded for a later release.docs-impact: 0 uncovered surfaces; the frozen paths are the three amended ADRs and status. Suspect pages read: reaction-signed (commands say on standard error what they signed: still true), runs, supervision, the guides; none made false.