Kevin Veen-BirkenbachandClaude Opus 5.5
454670a77e
Hooks run outside the sandbox but inherit a PATH whose directories sandboxed agents of the same uid can write (a virtualenv's bin activated first by the shell profile), so a file planted there under the name of docker, git or notify-send ran unsandboxed. hookpath.py keeps only the PATH directories that, with every parent, belong to another uid and that neither group nor others can write, as real paths; inside the sandbox's user namespace root shows as the overflow uid and still counts as sealed. watch.py, radio.py and council.py set that PATH before they start anything, and the cleanup child runs with -I. Both reminder hooks pin PATH=/usr/bin:/bin, and the install registers them with /usr/bin/bash and moves older bare bash and python3 entries to the absolute paths. 🎯 Fix: 90 % 💥 Break: 4 % 💸 Cost: 100 % ⏱️ Time: 100 % 🛡️ Security: 100 % 💰 Value: ? 🏆 Score: 86 🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 % Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
38 lines
1.3 KiB
Python
38 lines
1.3 KiB
Python
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
import os
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
REPO_ROOT = Path(__file__).resolve().parents[1]
|
|
HOOKPATH = REPO_ROOT / "skills" / "kvb-org-organize" / "scripts" / "hookpath.py"
|
|
|
|
|
|
def _load():
|
|
spec = importlib.util.spec_from_file_location("hookpath_under_test", HOOKPATH)
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
@unittest.skipIf(os.getuid() == 0, "every directory root creates is root-owned")
|
|
class TestHookpath(unittest.TestCase):
|
|
def test_only_sealed_directories_survive_as_real_paths(self):
|
|
hookpath = _load()
|
|
with tempfile.TemporaryDirectory() as tmp:
|
|
base = Path(tmp)
|
|
own = base / "bin"
|
|
own.mkdir()
|
|
link = base / "system"
|
|
link.symlink_to("/usr/bin")
|
|
path = os.pathsep.join([str(own), str(link), "", "/tmp", str(base / "missing"), "/usr/bin", "/bin"])
|
|
expected = list(dict.fromkeys(str(Path(d).resolve()) for d in ("/usr/bin", "/bin")))
|
|
self.assertEqual(hookpath.trusted(path).split(os.pathsep), expected)
|
|
self.assertEqual(hookpath.trusted(str(own)), "")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|