fix/freebsd-capability-gated-detection #10

Merged

clawdie merged 4 commits from fix/freebsd-capability-gated-detection into master

2026-09-14 06:40:04 +02:00

clawdie commented

2026-09-14 06:39:55 +02:00

Owner

No description provided.

clawdie added 4 commits

2026-09-14 06:39:55 +02:00

fix(tests): gate process-metadata tests on the capability, not the sysctl name 1e9e2e5bd8

The handoff test needs to read a foreground process's environment, and FreeBSD's
hardened default (security.bsd.unprivileged_proc_debug=0, what clawdie-iso ships)
denies that read even for a same-UID child. The test therefore cannot observe the
HERDR_AGENT hint on this host.

Probe the capability instead of the sysctl name: spawn a same-UID child with a
marker variable and read it back through get_process_environ, the same
KERN_PROC_ENV path the product uses. That stays correct when the policy is
overridden per jail, and it cannot silently skip forever because a sysctl binary
is missing or its output format changes.

Keep the skip auditable. libtest has no runtime skip status, so the test still
returns early, but it prints a greppable SKIP marker and HERDR_REQUIRE_PROC_DEBUG=1
turns an absent capability into a failure for full-coverage runs. Panicking on a
skip would make a deliberately hardened host permanently red; a static #[ignore]
would also skip hosts where the capability is present and the test is meaningful.

docs/FREEBSD.md carries the measured host-policy table and the per-capability
consequences, including that process_cwd cannot be implemented under this policy --
so the Stage 4 entry is blocked by policy rather than by effort.
docs/wiki/freebsd-host-policy.md records the why, and the wiki index links it.

Not verified in this commit: the FreeBSD build and test gate. This was written on
Linux without the pinned Zig toolchain, so cargo fmt/clippy/test on valhala is the
first real check.

docs: correct the ISO host-policy claim and record the --nocapture requirement 03424bc283

The first commit said the clawdie-iso image ships
security.bsd.unprivileged_proc_debug=0. It does not: the key appears nowhere in that
tree, so an ISO host keeps the stock default of 1. Only valhala's policy is verified
(/etc/sysctl.conf), and the port plan proposed baking a permissive value in rather
than a hardened one.

That changes the framing: the docs no longer present the hardened policy as the
target platform. Both policies exist in the field, which is the actual reason the
tests probe the capability instead of assuming a value.

Also records how to read the gate output: libtest captures a passing test's stderr,
so the SKIP line only reaches the log when the target runs with -- --nocapture.

docs(wiki): define ISO so the abbreviation gate passes b7260a67b5

The previous commit's wording introduced the acronym ISO and the lint failed on it.
The gate was right; this adds the row. Note the failure was masked in that commit by
piping the lint through tail, which reported tail's exit status instead.

test(cli): gate the two capability-dependent agent-start tests 12b6615069

Both fixtures identify the agent only through HERDR_AGENT on a process whose comm is
not the agent (exec /bin/sleep), so the env hint is the only signal -- and FreeBSD hosts
that set unprivileged_proc_debug=0 cannot read it. Confirmed as capability-dependent in
both directions on valhala, switching the sysctl by hand for the A/B.

Left ungated on purpose: agent_start_targets_existing_pane_over_socket in tests/api_ping.rs
has the same fixture shape and passes on a hardened host because it asserts the happy path
with an explicit kind -- detection yields None, so there is nothing to disagree with and no
mismatch is reported. Gating it would delete live coverage.

docs: record the flip/restore A/B, and the user-visible consequence it exposed -- when the
identity is only visible through the hint, a requested agent kind can no longer be
cross-checked, so a mismatched kind is accepted on a hardened host.

clawdie merged commit 528f881d1b into master

2026-09-14 06:40:04 +02:00

clawdie deleted branch fix/freebsd-capability-gated-detection

2026-09-14 06:40:04 +02:00

clawdie referenced this pull request from a commit

2026-09-14 06:40:05 +02:00

Merge pull request 'fix/freebsd-capability-gated-detection' (#10) from fix/freebsd-capability-gated-detection into master