fix(cli): bound tester supervisor cleanup and verify fast sessions (#1873) #1931

2026-11-11T14:49:07Z

jason.woltje commented

2026-11-11 14:49:07 +00:00

Tester supervisor (#1873): bound the cleanup scan cost and fix the exit-85 race on fast children. Both copies, scripts/case1-accept.sh and scripts/case2-unit.sh, change the same way and a test pins them byte-identical.

Cleanup was a bash read per /proc entry: 0.75 to 2.58 s on this host against about 2 s of headroom. It is now a fixed stdlib program run as /usr/bin/python3 -I -S, after the same root-owned path and ELF checks the script already applies to its other tools. It scans the whole session, not a parent tree, so reparented members are still found. Each target is pinned with pidfd_open and killed through pidfd_send_signal, so a reused PID cannot redirect the kill.
Security review P2 fixed: a later session reusing the same numeric SID could be mistaken for the original. The trusted session leader now stays alive through cleanup, and cleanup checks an open handle on its /proc dir before every kill. If the leader is gone, cleanup refuses (86) and never falls back to a bare SID scan.
Exit 85: bash reaps a fast child (node --version) before the session check sees it. A trusted shell now holds the session, stopped, until it is verified, then runs the command as its child. A child that never becomes a session leader is still refused.
No timeout budget, exit code or refusal text changed.

Measurements (host observer, no namespace): BASE alone 0.75 to 1.43 s, beside organization plus bus load 1.46 to 2.58 s. Final candidate alone max 0.04 s, loaded max 0.12 s. The 150-iteration per-entry mutant now costs nothing (0.03 to 0.04 s).

Review: security (daybreak-blue) changes 1 (P2), exact-fix re-check approve 0 with 199/199 checks.

Lane gate on 5e93356cf: whole cli 1519/0 after one isolated retry (untouched model-turn-reader FIFO nice assertion, 18/1 under load, 19/0 alone), test-case2 21/0, test-config 55/0, test-task 95/0. Total 1690/0. Lead check: case-supervisor-cost, case-session-identity, case-cleanup-time, case-inner-timing, case2-unit and case1-accept run alone, one at a time, 199/0.

Deferred, recorded: a descendant that calls setsid itself leaves the session and survives, on BASE and candidate alike; closing that needs a cgroup design. New host prerequisite: root-owned /usr/bin/python3 3.9+ with pidfd support (missing refuses 84 or 86). These scripts are not in stack-copy COPY_PATHS; Case 2 root host steps run from root's own checkout, which needs updating separately. No deploy here.

Tester supervisor (#1873): bound the cleanup scan cost and fix the exit-85 race on fast children. Both copies, scripts/case1-accept.sh and scripts/case2-unit.sh, change the same way and a test pins them byte-identical. - Cleanup was a bash `read` per /proc entry: 0.75 to 2.58 s on this host against about 2 s of headroom. It is now a fixed stdlib program run as `/usr/bin/python3 -I -S`, after the same root-owned path and ELF checks the script already applies to its other tools. It scans the whole session, not a parent tree, so reparented members are still found. Each target is pinned with `pidfd_open` and killed through `pidfd_send_signal`, so a reused PID cannot redirect the kill. - Security review P2 fixed: a later session reusing the same numeric SID could be mistaken for the original. The trusted session leader now stays alive through cleanup, and cleanup checks an open handle on its /proc dir before every kill. If the leader is gone, cleanup refuses (86) and never falls back to a bare SID scan. - Exit 85: bash reaps a fast child (`node --version`) before the session check sees it. A trusted shell now holds the session, stopped, until it is verified, then runs the command as its child. A child that never becomes a session leader is still refused. - No timeout budget, exit code or refusal text changed. Measurements (host observer, no namespace): BASE alone 0.75 to 1.43 s, beside organization plus bus load 1.46 to 2.58 s. Final candidate alone max 0.04 s, loaded max 0.12 s. The 150-iteration per-entry mutant now costs nothing (0.03 to 0.04 s). Review: security (daybreak-blue) changes 1 (P2), exact-fix re-check approve 0 with 199/199 checks. Lane gate on 5e93356cf: whole cli 1519/0 after one isolated retry (untouched model-turn-reader FIFO nice assertion, 18/1 under load, 19/0 alone), test-case2 21/0, test-config 55/0, test-task 95/0. Total 1690/0. Lead check: case-supervisor-cost, case-session-identity, case-cleanup-time, case-inner-timing, case2-unit and case1-accept run alone, one at a time, 199/0. Deferred, recorded: a descendant that calls `setsid` itself leaves the session and survives, on BASE and candidate alike; closing that needs a cgroup design. New host prerequisite: root-owned /usr/bin/python3 3.9+ with pidfd support (missing refuses 84 or 86). These scripts are not in stack-copy COPY_PATHS; Case 2 root host steps run from root's own checkout, which needs updating separately. No deploy here.

jason.woltje added 2 commits 2026-11-11 14:49:07 +00:00

fix: bound tester supervisor cleanup and verify fast sessions (#1873 ) f382699d47

fix: preserve tester session identity through cleanup (#1873 ) 4a122699a0

jason.woltje merged commit 4a122699a0 into refactor

2026-11-11 14:49:10 +00:00

jason.woltje referenced this pull request

2026-11-11 14:50:18 +00:00

fix(organization): check organization definitions against held credentials at start, launch, issue and hire (#1873) #1932

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1931