fix(ssh): bind /etc/ssh from a sanitized copy - #11
Merged
Merged
Conversation
- Closes #6 src/bubblebox.js: - bwrap maps only the invoking uid, so root-owned host config reads as nobody(65534) in the box - OpenSSH fatally rejects an Included config file owned by neither root nor the invoking user - so the host's global ssh_config aborted ssh before it ever reached the mounted ~/.ssh - copy /etc/ssh into the session dir with the Include lines commented out, bind that over /etc - the includes are host glue (systemd-ssh-proxy, distro crypto policy) that cannot pass the check - unreadable sources are skipped: the host private keys have no business in here anyway - the session dir is now 0700 and holds both the sandbox home and the copy, so cleanup stays one rm tests: - assert the copy is bound read-only after the host /etc, else it would be shadowed by it - feed the real ssh both configs: it rejects the fixture's include chain and accepts the copy - the fixture poisons its include with group-write rather than root ownership, which needs no root - a dry run now keeps the session dir, since that is where the copy the plan points at lives
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/etc/sshfrom a per-session copy owned by the invoking user, with everyIncludecommented out.ssh_config.ddoes lose that.ssh -Gandgit ls-remoteinside a box on NixOS, where both aborted before.nix flake checkfails without it.