Lane A (A.7-A.13): collectors, and a host boundary that now holds

[tom-snyder]

Summary

The poller, bulk-archive bootstrap, host collector, repo SCA collector, warm-start accelerator, and the two security critics. Both critics returned FAIL; two adversarial rounds followed.

The host read-only boundary

S7: the host agent is read-only — no package manager in a mutating mode, not behind a flag — and §0.2 reserved the strongest reviewer for it because a miss is unrecoverable on a server someone depends on.

The first guard matched callees by source spelling, and the critic proved it by compiling two host-mutating exec sites into the package that no analyser saw. That's the third time on this project a check has lost by matching names instead of resolving identity.

It now resolves by import path, treats a reference to a spawning function as a spawn site, and fails closed on what it cannot read — dot imports, blank imports, assembly bodies, go:linkname, any .s/.c/.syso. The import set became an allowlist, because the old denylist let a fourth file import anything nobody listed.

An adversary then compiled a mutating exec eight ways — alias, dot import, function value, in-package wrapper, method value, interface call — and every one was caught, most by 3–4 independent guards. All 18 mutating command lines refused. The systemd guard now covers every Exec* directive and every occurrence, and strips the +/!/!! prefixes that run outside the sandbox the unit's whole argument rests on.

The filesystem guard lost the same way and was fixed the same way: a hand-enumerated denylist permitted os.OpenRoot, the *os.Root methods, os.CopyFS and os.FindProcess().Kill(). A read-only collector that can kill processes is not read-only. Now an allowlist of eight operations, none of which writes, with handle tracking so os.OpenRoot → root.WriteFile is two findings rather than none.

And "no package this one may import can spawn a process" was documented, enforced nowhere, and false (os exports StartProcess). Deleted rather than softened — the rule this project reached after four revisions of an overstated compliance document — and replaced with a transitive import-graph check measured across four platforms with CGO on and off.

rpm -qa is not read-only, and the doc now says so

On a Berkeley-DB-backed rpmdb — RHEL/CentOS 7 and 8, SLES, Amazon Linux 2 — opening the database creates and updates /var/lib/rpm/__db.001..003 when the caller can write. No rpm flag suppresses it.

So the sentence claiming this collector never mutates the host was deleted, not qualified, and replaced with the precise statement: which distros, which backends, and the mitigation — which is not in this package at all. It's the unit's DynamicUser=yes plus ProtectSystem=strict, and removing either re-opens it.

The accelerator

Three blockers, all closed: the un-redistributable Trivy DB written into mirror/tier2 on Windows (byte-exact path comparison); the cache directory inside the git work tree matched by no ignore rule; and exchangeToken letting the registry choose where the operator's credential was sent, by parsing realm out of a header the registry controls — credential exfiltration driven by untrusted input, in a tool built to run against untrusted things.

Then a Windows directory junction (mklink /J, no elevation) defeated the fixed path check, because os.Lstat reports a junction as ModeIrregular and filepath.EvalSymlinks walks straight through. Fixed at configure time and write time, since a directory can be replaced by a junction between the two.

The reason that survived matters more than the bug

The one test that would have caught it skipped four times on this host and the package still printed ok. A.12 had independently found the same failure mode on a different guard. Twice is a pattern.

internal/SKIPPED-CONTROLS.md now inventories all 19 t.Skip sites, measured by running the suite rather than reading conditions: 11 legitimate, 9 hazards, 8 fixed. Among them a catch-all skip on the S7 "verified fixed" integrity gate that swallowed any fixture error, and two skips that fired when a checked-in file failed to load.

The ninth is closed here by me, because it needed a CI change: after the fix, the "a real scanner does not report a vulnerable fixture clean" control was honest but ran on no machine. There's now a trivy-e2e job that installs a pinned Trivy, runs it, then hides the binary and fails if the test still passes — a job that proves a control must itself be proved.

Testing

gofmt / vet / build   clean
go test -count=1      green across 17 packages

-race can't run on this Windows host; CI runs it on Linux.

For you, not fixed here

The accelerator's critic found a share-alike laundering path: the Trivy DB aggregates exactly the CC-BY-SA-4.0/ODbL upstreams mirror/tier2 quarantines, so a finding derived from that cache can reach publication without the quarantine ever being consulted — nothing crossed a tiered path. The directory rule works correctly and is answering a question that no longer covers the case. It may be a reason not to ship the accelerator at all.