-
Notifications
You must be signed in to change notification settings - Fork 0
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
Directory-holding-a-socket residual is live, not just 'as-written': enumerate+sign works, and a socket created after Validate is usable; existing test only checks --dry-run
area:testsCommitted suite, goldens, coverage gapsCommitted suite, goldens, coverage gapsbugSomething isn't workingSomething isn't workingsev:lowConfirmed finding, low severity or papercutConfirmed finding, low severity or papercutStatus: Open.#292 In gomoni/snug;The Authored-exemption sweep is not mechanical (a 4th writer ships green 3 ways) and types.go's own comment still says 'only Policy.Replace'
area:testsCommitted suite, goldens, coverage gapsCommitted suite, goldens, coverage gapsbugSomething isn't workingSomething isn't workingsev:lowConfirmed finding, low severity or papercutConfirmed finding, low severity or papercutStatus: Open.#291 In gomoni/snug;Socket-source refusal does not cover grafts: Validate accepts a graft whose source is a socket (latent)
area:policyPolicy model, profiles, resolution, bwrap argvPolicy model, profiles, resolution, bwrap argvbugSomething isn't workingSomething isn't workingsev:lowConfirmed finding, low severity or papercutConfirmed finding, low severity or papercutStatus: Open.#290 In gomoni/snug;Socket-refusal message tells the user to select '@ssh-agent', a profile snug does not ship
area:policyPolicy model, profiles, resolution, bwrap argvPolicy model, profiles, resolution, bwrap argvbugSomething isn't workingSomething isn't workingsev:lowConfirmed finding, low severity or papercutConfirmed finding, low severity or papercutStatus: Open.#289 In gomoni/snug;--dry-run/doctor/config attribute X11/D-Bus closure to the netns; they are pathname sockets closed by the mount policy, and a directory grant re-opens them
area:dry-runThe --dry-run trust artifactThe --dry-run trust artifactbugSomething isn't workingSomething isn't workingsev:mediumConfirmed finding, medium severityConfirmed finding, medium severityStatus: Open.#288 In gomoni/snug;ro is not read-only for a FIFO: a payload writes out through the default @parent-ro grant
area:policyPolicy model, profiles, resolution, bwrap argvPolicy model, profiles, resolution, bwrap argvbugSomething isn't workingSomething isn't workingsev:mediumConfirmed finding, medium severityConfirmed finding, medium severityStatus: Open.#287 In gomoni/snug;Orphan sweep kills on pid+starttime alone, ignoring the namespace inodes it recorded (hardening)
area:supervisorThe stage, process topology, teardownThe stage, process topology, teardownbugSomething isn't workingSomething isn't workingsev:lowConfirmed finding, low severity or papercutConfirmed finding, low severity or papercutStatus: Open.#285 In gomoni/snug;Container proxy bind filter defeated by create/start TOCTOU: symlink swap mounts the engine image store into a container
area:proxyThe podman socket proxy and build filterThe podman socket proxy and build filterbugSomething isn't workingSomething isn't workingsev:highConfirmed finding, high severityConfirmed finding, high severityStatus: Open.#284 In gomoni/snug;Idea: bound the sandbox's memory with a cgroup v2 memory.max, because --size bounds each mount and not their sum
enhancementNew feature or requestNew feature or requestStatus: Open.#283 In gomoni/snug;tmpfs mounts (/dev/shm, /tmp, $HOME) carry no size= bound — host-RAM-exhaustion DoS from inside
area:policyPolicy model, profiles, resolution, bwrap argvPolicy model, profiles, resolution, bwrap argvsev:lowConfirmed finding, low severity or papercutConfirmed finding, low severity or papercutStatus: Open.#281 In gomoni/snug;The stage's --unshare set is checked against bwrap --help but never against snug's emitted argv
area:supervisorThe stage, process topology, teardownThe stage, process topology, teardownarea:testsCommitted suite, goldens, coverage gapsCommitted suite, goldens, coverage gapssev:lowConfirmed finding, low severity or papercutConfirmed finding, low severity or papercutStatus: Open.#277 In gomoni/snug;Warm engine store is silently orphaned when the profile selection's spelling changes
area:proxyThe podman socket proxy and build filterThe podman socket proxy and build filtersev:lowConfirmed finding, low severity or papercutConfirmed finding, low severity or papercutStatus: Open.#276 In gomoni/snug;