Grant log paths as both literal and subtree - #325
Merged
Conversation
--log-path appended /** unconditionally, so a path naming a single file (/var/log/php8.5-fpm.log, the common case for PHP-FPM) produced "/var/log/php8.5-fpm.log/**", which matches nothing. The grant looked present in the config and did nothing — the same silently-ineffective-rule class as the root-file glob trap this policy already documents. Emit both the literal path and the subtree pattern for every declared log path, in external_directory (allow) and edit (deny). Covers directory and file forms with no detection and no over-match; `/var/log/nginx*` would have matched /var/log/nginx-other too. Shipped in v1.11.2 and caught while wiring the first real log grant.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
--log-path(v1.11.2, #322) appended/**unconditionally:PHP-FPM's error log is a single file, so that pattern matches nothing. The grant is present in the config, reads as correct, and does nothing — leaving the agent unable to read the log it was explicitly given access to.
Same class as the root-file glob trap already documented in
lib/source-policy.sh: a pattern that looks right and silently matches the empty set. Caught while wiring the first real log grant on h44lacrosse.com, where the paths are/var/log/nginx(directory) and/var/log/php8.5-fpm.log(file).Fix
Emit both forms for every declared path, in
external_directory(allow) andedit(deny):Covers directory and file with no detection and no over-match. The tempting one-pattern alternative,
/var/log/nginx*, would also match/var/log/nginx-other— OpenCode's*becomes.*and spans anything.Tests
tests/posture.shnow asserts both the literal and the subtree form are granted for read and denied for edit, with a comment explaining why one alone is insufficient.Full suite: no new failures (same 7 pre-existing environment failures as
main).