[scanner] fix: test_git_credential_hive.sh mode-notice cases hermetic on per-UID hives (bin/test_git_credential_hive.sh) - #6179
Open
kubestellar-hive[bot] wants to merge 1 commit into
Conversation
…metic on per-UID hives Run as an agent UID (>= 2001), git-credential-hive.sh derives AGENT from /var/run/hive/uid-map.json - deliberately ignoring HIVE_AGENT, which an agent could spoof - and then reads that REAL agent's live /tmp/.hive-mode-AGENT file. The harness's unique TEST_AGENT and HIVE_AGENT_MODE were silently ignored, so the two mode-notice assertions tracked the host's deployment state: on this host (scanner, UID 2008, mode ISSUES_AND_PRS) they failed; on a host whose live mode is ADVISORY they would pass vacuously for every case. Stub id(1) on PATH inside run_helper so "id -u" reports a sub-2001 UID, forcing the helper down the HIVE_AGENT/HIVE_AGENT_MODE path the harness already controls. Every other id invocation passes through to the real binary. The helper itself is untouched - the uid-map derivation is a security property, not the bug. Fixes #6178 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: sec-check <sec-check@hive.kubestellar.io>
kubestellar-prow
Bot
added
the
dco-signoff: yes
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
kubestellar-prow
Bot
added
the
size/S
Open
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix
Makes the mode-notice cases in
bin/test_git_credential_hive.shhermetic on per-UID hives. Claimed ground:bin/test_git_credential_hive.shonly (the helperbin/git-credential-hive.shis deliberately untouched), plus achangelog.dfragment. Disjoint from the open hermeticity PRs #6120 (dashboard rescan route test) and #6097 (SIGPIPE sweep).At agent UIDs (>= 2001) the helper derives AGENT from
/var/run/hive/uid-map.json— a security property, so an agent cannot spoofHIVE_AGENT— and then reads that real agent's live/tmp/.hive-mode-<agent>. The harness's uniqueTEST_AGENTand per-caseHIVE_AGENT_MODEwere silently ignored: on this host (scanner, UID 2008, live modeISSUES_AND_PRS) the two notice assertions failed; on a host whose live mode isADVISORYthey would pass vacuously.The harness now prepends a stub
idtoPATHinsiderun_helperthat reports UID 1000 for exactlyid -uand execs the real binary for anything else, forcing the helper down the env-var path each case controls.Verified: 13 passed / 2 failed before, 15 passed / 0 failed after, on a live per-UID host;
bash -nclean.Fixes #6178
Filed by scanner agent (ACMM L5 — hold-gated mode). Hold-gated: human review required.
— hive: agent=scanner backend=copilot model=claude-fable-5