[LeChatP]

This is massive bugfix, and fixes also a lot of security issues. This version and the previous one are the result of co-working with Claude. This is has to be done I was completely blind about these. But then I have to compare it more or less like all other project that have thousands of bugfix from Mythos, but with Opus 5.5.

First of all, I did some mistakes about choosing a implementation for env vars management that were inevitably insecure at some point. Claude made me a proof of it.

The workdir feature weren't correctly located in the exec order. I thought that position would be a feature, but was a problem, and Claude gave me a proof.

The PATH management struggled inside the hierarchy of the configuration.

There was a logic bug in the task matching making in some cases winning a task with more privileges than the other.

TZ check algorithm is stricter than before, and so better.

RootAsRole denies policy file with other permission enabled.

RootAsRole now logs successful commands into syslogs, and also preventing forging indesirable chars into this syslog.

Several bugs with PATH management, we could have some relative path that could become "legitimate".

** is now really working as a wildcard for all binaries. Use with care ofc.

Hierarchy of roles had logic bugs.

After seeing some blocking point on pcre2 on debian CI, the dependency is now dropped in favour of regex from BurntSushi, and for trust reasons, RootAsRole switched from glob lib to globset from burntsushi. This is thanks to my last cargo vet iteration.

For making this new version transparent for current policies, RootAsRole firstly uses my 2 years old implementation of Migration type... I finally have a usage of this feature lol.

And it also refactored code that was duplicate since the optimisation update.

And there many more small bugfixes. Described below from an extract of the git log result. You'll see that the git log is incredibly easy to read, for me at least, but is mostly Claude text.

---

• fix: a rule of the policy can now match an argument that holds quotes, they were removed before matching
• fix: the outer quotes of every argument were removed, recursively, so dosr echo '"a"' ran echo a; a leftover of the pest grammar that parsed a joined command line, the shell already removed its quoting before dosr runs
• fix: dosr passes its arguments as they are given
• fix: a pre-exec step at the new WORKDIR stage enters it after the credentials and the capabilities are set; the path is prepared before the fork, and a directory the target cannot enter is an error, like with sudo
• fix: std applies Command::current_dir before the pre-exec steps, so the directory asked with -D, or forced by the policy, was entered with the rights ofthe user running dosr, before the switch to the target user
• fix: the working directory is entered as the target user
• fix: -p without a prompt is an error instead of a panic
• fix: the command line written in the logs on an error is read lossily and its control characters are escaped
• fix: an argument that is not UTF-8 is refused with an error, the policy matches text; a variable that is not UTF-8 is never passed to the command
• fix: std::env::args() and std::env::vars() panicked on a value that is not UTF-8: one such variable in the environment of a user made dosr unusable for this user
• fix: dosr does not panic on arguments or variables that are not UTF-8
• fix: the matching actor of a role was logged at the info level on every run, it is now a debug message
• fix: unimplemented! was reached from the content of the policy and made dosr panic; an actor of a type that this version does not know now never matches, with a warning, and the other actors of the role still match
• fix: an unknown actor type in the policy is ignored instead of crashing dosr
• fix: a role disabled by the separation of duties plugin still gave the tasks of its parents
• fix: a member of the senior role never got the tasks of its parents, they were scored with the actors of the parent role
• fix: a user that holds no role was accepted, with an empty task and command, as soon as a role of the policy had parents whose command matched; dosr then went on to authenticate and log an execution that could not run
• fix: the hierarchy plugin gives the tasks of the parent roles to the members of the senior role only
• fix: ** matched without giving the path to run, so a task with "commands": ["**"] was never chosen; the command of the user is now resolved like with the all default behavior, a name only in PATH
• fix: the ** command pattern of the policy matches any binary
• fix: a command path with a wildcard in the policy never matched: the pattern had to end with the command path, was wrapped in ^...$, and a match was never marked as matching
• fix: with -D, the current directory of the user was checked too, although the command runs in the requested directory
• fix: a task forcing its working directory ("workdir": "/path" or a fallback) was refused unless the current directory of the user was also allowed, sothe short form could never be used
• fix: only the directory the command runs in is checked against the allowed workdirs
• fix: a level setting the allowlist or blacklist mode erased the inherited lists and fallback, so a directory removed by an upper level could be allowed again
• fix: chsr showed a third resolution, where an inheriting level could not remove a directory already added
• fix: in keep mode, the directories of the policy now come before those of the user, so they are found first
• fix: in dosr, a keep-safe or keep-unsafe level ignored its own add and sub lists, so its sub list did not remove the directories of the user
• fix: in dosr, a level setting the delete mode without an add list emptied the PATH, it now inherits the directories of the upper levels
• fix: the '..' check looked at the first dot of the value instead of the current one, so a checked TZ such as Etc.x/../../etc/shadow was passed to the command; every path element is now compared with '..'
• fix: a TZ value with a '..' element after another dot was accepted
• fix: when the policy allowed overriding the env behavior, a command line filter without -E (such as -r) kept the built-in default behavior and ignored the global, role and task levels
• fix: chsr showed resolved env lists that dosr did not apply: a variable in both the check and delete lists was hidden from both, and a requested behavior was shown even when the policy forbids overriding it
• fix: with CBOR, commands were matched while the policy was read, with the default PATH, because the options of a task and of its role are written after its commands: the PATH of the task was ignored, a command outside of it was allowed
• fix: CBOR commands are resolved in the PATH of their own task
• fix: a denied command only denied its task when it matched better than the best task so far, and it replaced the best command
• fix: a task with the same command match as the best one was never compared, the first one won even when it needed more privileges
• fix: the best settings were changed while a task was evaluated, before knowing if it was better: a losing task replaced the command to run and the command score, so a worse task could win afterwards
• fix: a task cannot change how the next tasks are compared
• fix: dosr resolved the commands of a task with the PATH of the global options and of the best task found so far, so a command could be found in a directory that the task's PATH does not contain, or not found in one that it does
• fix: commands are resolved in the PATH of their own task
• fix: a level switching to keep mode without a delete list passed every variable, it now inherits the delete and check lists of the upper levels and of the defaults
• fix: an env list that a level does not define is inherited, even when the level sets its default behavior
• fix: errors were only logged and chsr exited with 0, so scripts could not detect a failed command or a usage error
• fix: chsr exits with a failure status when a command fails
• fix: chain unchanged migrations from 4.0.0, a policy saved by an older 4.0.x version failed to load in chsr with "No migration path"
• fix: the error is now reported with the invalid entry
• fix: lhs_deserialize_envkey and lhs_deserialize turned any error into None, so one invalid entry removed the entire keep/check/delete (or path) list, and chsr saved it that way
• fix: an invalid entry silently dropped the whole env or path list
• fix: chsr and rootasrole-core refuse invalid entries such as regexes (LC_.*) with an explicit message
• fix: dosr silently dropped invalid env entries, a task inheriting one is now denied with an error naming the entry
• fix: control characters are escaped so an argument cannot forge another log line
• fix: the Arch install script always exited with an error after copying the default policy (cp || log && exit 1)
• fix: xtask and the Arch install script create new policy files with mode 0600
• fix: the owner is not checked, root is not trusted more than any other account
• fix: the main settings file, the policy file and their directories are refused when writable by others, a warning is logged when others can read them
• fix: dosr refuses policy files that other users can write
• fix: env patterns came from the user's variable name instead of the policy, so LC_.* never matched LC_ALL
• fix: a variable in both keep and check lists is checked, in keep mode the delete list wins over the check list
• fix: values starting with () (exported shell functions) are never passed
• fix: in keep mode, the default delete list removes the dynamic loader, shell and interpreter variables (LD_*, BASH_ENV, IFS, PYTHONPATH...), it had only6 entries
• fix: environment filtering follows sudo's rules
• fix: an explicit command path is not canonicalized anymore, multi-call binaries keep the name they are run with
• fix: relative PATH entries are ignored when resolving commands
• fix: with a task allowing every command, dosr ls ran ./ls if it existed, it is now only searched in PATH
• fix: a command name is never resolved in the current directory
• fix: unreachable today since no pattern can be created without pcre2, kept fail-closed for the future
• fix: without pcre2, an env pattern matches nothing instead of everything

[codecov]

Codecov Report

❌ Patch coverage is 87.21351% with 106 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.02%. Comparing base (dd192bb) to head (cf4da3f).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
src/dosr/lib.rs	70.83%	21 Missing ⚠️
core/src/file.rs	79.74%	16 Missing ⚠️
src/dosr/fuzzing.rs	50.00%	14 Missing ⚠️
src/dosr/finder/mod.rs	81.69%	13 Missing ⚠️
src/chsr/cli/process/upgrade.rs	86.66%	6 Missing ⚠️
src/dosr/finder/options.rs	94.00%	6 Missing ⚠️
core/src/database/env.rs	94.73%	5 Missing ⚠️
fuzz/fuzz_targets/config_parse.rs	0.00%	5 Missing ⚠️
src/dosr/pre_exec.rs	16.66%	5 Missing ⚠️
core/src/util.rs	93.93%	4 Missing ⚠️
... and 7 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #107      +/-   ##
==========================================
+ Coverage   68.50%   73.02%   +4.52%     
==========================================
  Files          55       60       +5     
  Lines        6426     6487      +61     
==========================================
+ Hits         4402     4737     +335     
+ Misses       2024     1750     -274     

Flag	Coverage Δ
admin-unittests	73.02% <87.21%> (+4.52%)	⬆️
unittests	72.97% <87.21%> (+4.50%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.