Skip to content

📖 scanner: mark agent env residual lane open - #4847

Merged
clubanderson merged 1 commit into
v4from
fix-4845-doc-open-lane
Aug 27, 2026
Merged

📖 scanner: mark agent env residual lane open#4847
clubanderson merged 1 commit into
v4from
fix-4845-doc-open-lane

Conversation

@clubanderson

@clubanderson clubanderson commented Aug 27, 2026

Copy link
Copy Markdown
Member

Fixes #4845

Summary

Cause

Commit aa00145 documented the H3 residual as already closed by MITM proxy Authorization strip/inject, but PR #4032 is still open/parked and v4 only has an aspirational #1861 proxy comment.

Test

  • TMPDIR=$PWD/.scratch-tmp bash bin/test_agent_env_scrub.sh

@clubanderson
docs: mark agent env residual lane open
b934736 
bin/agent-env-scrub.sh claimed same-uid /proc environ extraction was already closed by the proxy Authorization strip/inject lane from #1861/#4032. That mitigation is still parked in PR #4032, so document the residual as open until that work lands and note that smuggled credentials remain usable against GitHub today.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Andrew Anderson <andy@clubanderson.com>
@kubestellar-prow kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Aug 27, 2026
@kubestellar-prow

kubestellar-prow Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Changelog: this PR changes code but does not touch CHANGELOG.md.

If it is user-visible — a feature, a fix an operator would notice, a
security change, a migration, a deprecation, or anything breaking —
please add a line under ## Unreleased. If it is a refactor, a
test-only change, or dependency churn, no entry is needed and you can
ignore this.

This is a reminder, not a gate; it never blocks a merge.

@kubestellar-prow kubestellar-prow Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Aug 27, 2026
@clubanderson
clubanderson merged commit 691432e into v4 Aug 27, 2026
26 of 27 checks passed
@kubestellar-prow
kubestellar-prow Bot deleted the fix-4845-doc-open-lane branch August 27, 2026 00:54
@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Thank you for your contribution! Your PR has been merged.

Check out what's new:

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dco-signoff: yes Indicates the PR's author has signed the DCO. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[scanner] agent-env-scrub.sh claims /proc environ extraction lane is 'closed' by proxy auth strip/inject, but PR #4032 is unmerged

1 participant

@clubanderson