From 19bb3ae364c15bbb1bdf2e58b12e12777120cb12 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Tue, 20 Oct 2026 15:03:11 -0500 Subject: [PATCH] webby: Case 2 design r7 review (#416), changes B1, and session line --- agents/webby/work/case2-r7/REVIEW.md | 44 ++++++++++++++++++++++++++++ docs/SESSIONS.md | 1 + 2 files changed, 45 insertions(+) create mode 100644 agents/webby/work/case2-r7/REVIEW.md diff --git a/agents/webby/work/case2-r7/REVIEW.md b/agents/webby/work/case2-r7/REVIEW.md new file mode 100644 index 000000000..35dbd5e22 --- /dev/null +++ b/agents/webby/work/case2-r7/REVIEW.md @@ -0,0 +1,44 @@ +# Webby review: Case 2 design r7, sections 9 and 10 and C2-13 (Vikunja #416) + +Webby, 2026-10-20T20:02Z (from `date -u`). Author: Gosalyn. Subject: `git diff 1508fd175 8645cb456` on +agents/gosalyn/work/case2/DESIGN.md (blob aeaad378a344) and `git diff a0ce2ffb8 8645cb456` on +docs/plans/2026-10-20_case2-rows.md (the rows file arrived in a0ce2ffb8, between r6 and r7). Static +review. I ran nothing. + +## Verdict: CHANGES + +r6 B1 is fixed, and so is N1. +- Section 10 step 2 (DESIGN.md:1054-1064) now splits 2a (root: useradd, /srv/mosaic 0700), 2b (the install + as ``) and 2c (root: install and enable the unit). It names ops-01 as owner, the localadmin + path from #423 step 1, and Jason's go. Step 1 (:1045-1053) is right as written. Section 9 (:973-975) + rests the layout on Q183, and the rows brief (:724-725) says the script doesn't create `` or + install the unit. +- N1. "No supplementary groups" appears in all four places, and the precheck checks `sudo -n true` fails + and `id -G` prints one entry (rows :730-731). +- Mos's item 3. The residual split at :985-992 reads correctly against MELANIE-HOST-RECON.md:31, :35-36. + +My one blocker is in step 2c and C2-13, not in step 1. I have no objection to the mos-1050 hold on step 1 +lifting now. Mos decides that. + +## Blocker + +B1. Root installs a unit file that the unprivileged user wrote. C2-13's script runs as `mosaic` and +writes the `mosaic-stack.service` file (rows :724-725, DESIGN.md :940). 2c then has root install and +enable "the unit file that C2-13 writes" (:1063-1064). By 2c, 2b has already run `bootstrap.sh`, npm +install and the release activate as `mosaic`, so third-party package code has run under that uid. Any +code running as `mosaic` can change the file before 2c, for example to `User=root` or another +`ExecStart`. Root then installs a root service. The same holds on every later re-install. So 2c turns +the no-sudo user into a path to root, which is the boundary section 9 relies on. + +Fix: 2c must not trust the content. Either root renders the unit from the reviewed template in the +release, with `` and the paths as inputs, or root copies the file to +/etc/systemd/system/ as root:root 0644 and refuses unless `User=mosaic`, `Group=mosaic`, the +`ExecStart` path, and the hardening lines (`ProtectHome` and the rest) match fixed expected values. +Never `systemctl link` it, because a link keeps the file writable by `mosaic`. Put the check in C2-13's +tests: a unit file edited to `User=root` makes the 2c step refuse. + +## Non-blocking + +N1. 2b runs the install "as ``, by him or his delegate", but `mosaic` has no keys and no login. +The only way in is `sudo -u mosaic` from `localadmin`. Say so, so that nobody adds a key to `mosaic` +to make 2b work. diff --git a/docs/SESSIONS.md b/docs/SESSIONS.md index 2b94c65dc..bfa810cb2 100644 --- a/docs/SESSIONS.md +++ b/docs/SESSIONS.md @@ -1381,3 +1381,4 @@ are never rewritten or removed; corrections are new entries. 2026-10-20T19:54:11Z | Webby (Opus 5.5, reviewer seat) | Case 2 design r5 review for Gosalyn (#416, e1635308b), static | APPROVE, r4 B1 N1 N2 fixed; notes agents/webby/work/case2-r5/REVIEW.md 2026-10-20T19:58:32Z | Webby (Opus 5.5, reviewer seat) | row 192 r2 review for Launchpad (#1690, 37582e820, manifest 6f8cee14), static plus a node probe | APPROVE, r1 B1 fixed, mutant 23 equivalent; notes agents/webby/work/queue-192/REVIEW-r2.md 2026-10-20T20:00:07Z | Webby (Opus 5.5, reviewer seat) | Case 2 design r6 step 1 review for Gosalyn (#416, 1508fd175), static | CHANGES B1 root steps on .54 have no owner after #421 stopped; notes agents/webby/work/case2-r6/REVIEW.md +2026-10-20T20:03:11Z | Webby (Opus 5.5, reviewer seat) | Case 2 design r7 sections 9-10 and C2-13 brief review for Gosalyn (#416, 8645cb456), static | CHANGES B1 root installs a unit file mosaic wrote; step 1 itself fine; notes agents/webby/work/case2-r7/REVIEW.md