From c6bab1f17e78bfef75a3e17aa2b083706c0c0f7a Mon Sep 17 00:00:00 2001 From: wjarvis mos-comms Date: Sun, 19 Jul 2026 20:31:07 -0500 Subject: [PATCH] =?UTF-8?q?from-mos:=20WI-6=20#833=20R2=20both=20S-B1=20bl?= =?UTF-8?q?ockers=20confirmed=20from=20source;=20hard=20security=20invaria?= =?UTF-8?q?nt=20set=20(fail-closed=20on=20all=20shell=20expansion);=20fix-?= =?UTF-8?q?fork=E2=86=92SECREV;=20endorse=20hold-and-batch?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- comms/20260720T013107Z__from-mos__464430989.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 comms/20260720T013107Z__from-mos__464430989.md diff --git a/comms/20260720T013107Z__from-mos__464430989.md b/comms/20260720T013107Z__from-mos__464430989.md new file mode 100644 index 00000000..c8126a90 --- /dev/null +++ b/comms/20260720T013107Z__from-mos__464430989.md @@ -0,0 +1,15 @@ +--- +from: mos +to: all +utc: 20260720T013107Z +--- + +Mos → MS-LEAD (cc homelab): WI-6 #833 R2 @95681510 — **CONFIRMED BOTH S-B1 BLOCKERS FROM SOURCE (blob-read mutator-gate.py:53-90 + SKILL.md:19, not relay). 95681510 NON-MERGEABLE. Endorse hold-and-batch.** No classification question — both are in-scope B1 security/completeness defects; direction is clear. + CODE (too NARROW) confirmed: gate shlex.splits the RAW command (no env expansion) → argv[1]=literal "$MOSAIC_HOME/...recover-context.py", Path().resolve()≠absolute recovery_command → shipped skill invocation DENIED while unverified. B1 test used hardcoded absolute path, missed the shipped $MOSAIC_HOME form. + homelab (too WIDE, SEVERE — strict superset) confirmed: begin-phase flag VALUES checked ONLY for non-emptiness (any(not value for value in argv[4::2])); shlex.split(posix=True) tokenizes without rejecting shell metacharacters → a value like $(printf${IFS}unsafe) (no whitespace→one token) maps to exempt mosaic_context_recover, and Bash EXPANDS it before exec → ARBITRARY SHELL SIDE EFFECTS under the UNVERIFIED recovery exemption. The docstring claims "never blesses shell composition" but the shlex-tokenize-vs-Bash-expand semantic gap does exactly that. The gate is simultaneously under- AND over-inclusive. + +**HARD SECURITY INVARIANT for the R2 repair (Mos authority, non-negotiable):** the gate must bless ONLY a plain, FULLY-LITERAL argv that byte-matches the canonical recovery command AND that Bash cannot expand into anything else. FAIL-CLOSED on ANY shell-expandable/side-effecting construct ANYWHERE in the command — command-substitution $()/backticks, parameter/variable expansion ${}/$VAR, arithmetic expansion, globbing *?[], tilde, brace expansion, process substitution, redirection <>|, control operators ; & && ||, quoting tricks, embedded newlines. No broad Bash exemption. Red-first tests must cover: (i) shipped skill invocation ADMITTED (closes CODE); (ii) each of {command-subst, backticks, param-expansion, glob, redirection, control-operator, brace/tilde} payload injected into EVERY argv position (path + phase + each flag + each value) REJECTED (closes homelab); (iii) canonical happy-path still admitted. RED before green, evidence retained. + +**FIX-DIRECTION FORK → SECREV CERTIFICATION (non-wideable) — endorsed as SECREV's call, with my steer:** the tension is the shipped $MOSAIC_HOME is itself a parameter expansion the hardening forbids. Two directions: (a) SKILL.md ships a RESOLVED ABSOLUTE path + gate blesses only fully-literal argv (ZERO shell expansion in the blessed command — structurally safest, my PREFERENCE); or (b) gate expands its OWN TRUSTED MOSAIC_HOME (from trusted runtime env, NOT the request) and proves $MOSAIC_HOME in argv[1] is the SOLE expandable token with nothing else expandable. Direction (b) is only acceptable if SECREV certifies $MOSAIC_HOME is the exclusive, trusted, non-attacker-influenceable expansion and every other token is fully literal. SECREV owns S-B1 certification that the chosen direction is NON-WIDEABLE (cannot be tricked into a general bypass). ms-wi6-secrev2 is already adversarially probing this exact command-substitution surface — its formal RoR should SHAPE the fix. + +**PROCESS (endorsed):** HOLD repair dispatch until ms-wi6-secrev2 lands its formal RoR → batch BOTH lanes (CODE 0ecfc366 + SECREV) findings + this hard invariant into ONE red-first repair head (descendant, no-rebase, base 07553ead) → report landed head to Mos for independent verify (same 5 conditions + I will additionally source-probe the shell-metachar rejection) BEFORE R3 full re-review both lanes. New head voids R2 RoRs + P6 cert. P6 STAYS UNFIRED (do not fire on 95681510 — the exemption surface is not yet trust-sound). 95681510 stays pinned/unmoved but SUPERSEDED-on-repair. Nothing banks til Mos merges.