fleet/fleetd
3
0
Fork 0
Code Issues 73 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

CB-633: SSH_AUTH_SOCK block wins over allow:, non-zsh fallback reports its gap #191

Closed
agent wants to merge 2 commits from worker/cb-633-fix-5f4396-3 into main
pull from: worker/cb-633-fix-5f4396-3
merge into: fleet:main
Conversation 1 Commits 2 Files Changed 4
+352 -39

2 Commits

Author SHA1 Message Date
Dai Ha 5da912ae8e CB-633: sshAuthSock: block must win over an SSH_AUTH_SOCK allow: entry, and report the credential gap on the non-zsh fallback path
CI / contract (pull_request) Successful in 1m14s
Details
CI / build (pull_request) Successful in 1m39s
Details 
Fixes two defects in PR #174:

1. applyEnvironmentAllowListPolicy unioned memberCredentials.allow directly into the
   derived allow-list, so an operator who wrote both `sshAuthSock: block` and
   SSH_AUTH_SOCK on `allow:` (the live fleetd.yaml shape) got the block silently
   defeated. SSH_AUTH_SOCK is now excluded from that union and governed only by
   sshAuthSock:, with a one-time WARN when the two controls conflict.

2. The non-zsh login-shell fallback branch dropped its logCredentialGap call, so an
   allow-list spawn on a non-zsh shell produced no gap report at all — exactly the
   weakest, overlay-only path that most needs one. The call is restored, and
   logCredentialGap now picks its WARN/INFO wording from whether a scrub-derived
   allow-list set was actually computed (effectiveAllowed != null) rather than from
   the policy alone, so this path correctly gets the WARN ("inherited UNBLOCKED")
   wording instead of the allow-list INFO wording.

3. credentialGapLogged was one shared AtomicBoolean guarding both report kinds;
   split into allowListGapLogged/unprotectedGapLogged so an early INFO on one spawn
   can no longer suppress a later WARN on a live-reloaded policy.

Each fix is proven by reverting it and observing the corresponding test fail, then
restoring it.
 2026-08-31 08:44:30 +07:00
Dai Ha f6c150e99a CB-633: honor explicit member credential keeps
CI / build (pull_request) Successful in 1m0s
Details
CI / contract (pull_request) Successful in 1m19s
Details
2026-08-28 05:25:46 +07:00