mosaicstack/stack
25
0 Fork 1
Code Issues 404 Pull Requests 13 Packages Projects Releases 15 Wiki Activity

Dev local owner: refuse local agent peers on owner controls (F3 review P1) #1883

New Issue
Open
opened 2026-11-09 20:08:43 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-11-09 20:08:43 +00:00
Owner
Copy link
Copy source

Follow-up from the F3 review (report: org-f3-review.md, finding P1), part of #1873.

On a --dev-local-owner Console every request that passes the Host and Origin checks acts as the owner. A local agent runs as the same OS user and can send Origin and Sec-Fetch-Site: same-origin itself, so it reaches the F3 controls: Console restart (202), bus restart (200), name and routing writes (200). The reviewer reproduced all three.

This matches the pinned startup warning ("launched agents run as this OS user and can reach the loopback Console as owner") and Jason's 11-09 ruling accepting the no-auth dev flags. The F3 fix round corrected the README, which had claimed no agent reaches these controls.

Proposed hardening, cooperative like the CLI and bus marker checks:

  • For a peer on a local address (loopback or one of the host's own interface addresses), find the client socket in /proc/net/tcp{,6}, its owning PID via /proc/*/fd, and walk its ppid chain.
  • Refuse 403 agent-refused when a process in that chain that is not also an ancestor of the Console carries an agent marker (MOSAIC_BUS_CAP, MOSAIC_RUN_ID, MOSAIC_AGENT_RUN, CLAUDECODE, CLAUDE_CODE_ENTRYPOINT, CODEX_THREAD_ID, PI_AGENT_DIR). Excluding the Console's own ancestors keeps tests and agent-started scratch Consoles working.
  • Refuse an unresolvable local peer (fail closed). This includes a client in another network namespace that connects through a local interface address.
  • Decide how devstack agent E2E keeps reaching scratch instances: a launch flag, or run the client through systemd-run.

Residual even after this: an agent that strips its markers and leaves the process tree, or any same-user shell. Sign-in (--sso) is the boundary.

Follow-up from the F3 review (report: org-f3-review.md, finding P1), part of #1873. On a `--dev-local-owner` Console every request that passes the Host and Origin checks acts as the owner. A local agent runs as the same OS user and can send `Origin` and `Sec-Fetch-Site: same-origin` itself, so it reaches the F3 controls: Console restart (202), bus restart (200), name and routing writes (200). The reviewer reproduced all three. This matches the pinned startup warning ("launched agents run as this OS user and can reach the loopback Console as owner") and Jason's 11-09 ruling accepting the no-auth dev flags. The F3 fix round corrected the README, which had claimed no agent reaches these controls. Proposed hardening, cooperative like the CLI and bus marker checks: - For a peer on a local address (loopback or one of the host's own interface addresses), find the client socket in /proc/net/tcp{,6}, its owning PID via /proc/*/fd, and walk its ppid chain. - Refuse 403 `agent-refused` when a process in that chain that is not also an ancestor of the Console carries an agent marker (MOSAIC_BUS_CAP, MOSAIC_RUN_ID, MOSAIC_AGENT_RUN, CLAUDECODE, CLAUDE_CODE_ENTRYPOINT, CODEX_THREAD_ID, PI_AGENT_DIR). Excluding the Console's own ancestors keeps tests and agent-started scratch Consoles working. - Refuse an unresolvable local peer (fail closed). This includes a client in another network namespace that connects through a local interface address. - Decide how devstack agent E2E keeps reaching scratch instances: a launch flag, or run the client through systemd-run. Residual even after this: an agent that strips its markers and leaves the process tree, or any same-user shell. Sign-in (`--sso`) is the boundary.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) darkwing (Mosaic fleet seat darkwing) dewey (Mosaic fleet seat dewey) fargo filbert (Mosaic fleet seat filbert) fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate mosaic-stack-coder-bot (mosaic-stack coder bot) mosaic-stack-cto-bot (mosaic-stack cto bot) mosaic-stack-pm-bot (mosaic-stack pm bot) ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) rocko (Mosaic fleet seat rocko) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1883