Deny gate host configuration reads

Makefile

@@ -95,9 +95,7 @@ check-compiler:
 				"$$gate_tools/fs-sandbox" \
 				--dir / \
 				--ro /usr \
-				--ro /etc \
 				--ro /proc \
-				--ro /sys \
 				--ro "$$gate_tools" \
 				--ro "$$gate_tools/toolchain" \
 				--rw /dev/null \
@@ -112,6 +110,8 @@ check-compiler:
 				CARGO_NET_OFFLINE=true \
 				CARGO_TARGET_DIR="$$cargo_home/target" \
 				CARGO_TERM_COLOR=never \
+				GIT_CONFIG_GLOBAL="/dev/null" \
+				GIT_CONFIG_NOSYSTEM="1" \
 				HOME="$$cargo_home/home" \
 				LANG=C \
 				LC_ALL=C \
@@ -167,7 +167,7 @@ check-compiler:
 	/usr/bin/env -i LANG=C LC_ALL=C PATH=/usr/bin:/bin /usr/bin/cc -std=c17 -O2 -D_FORTIFY_SOURCE=3 -fPIE -pie -Wall -Wextra -Werror -pedantic -Wl,-z,relro,-z,now "$$cargo_home/check-src/tools/fs_sandbox.c" -o "$$gate_tools/fs-sandbox"; \
 	[[ -f "$$gate_tools/fs-sandbox" && ! -L "$$gate_tools/fs-sandbox" && -x "$$gate_tools/fs-sandbox" ]] || { printf '%s\n' 'filesystem sandbox build is invalid' >&2; exit 1; }; \
 	manifest="$$cargo_home/check-src/compiler/Cargo.toml"; \
-	run_cargo /bin/bash -p -c 'for capability_set in CapInh CapPrm CapEff CapBnd CapAmb; do [[ "$$(/usr/bin/sed -n "s/^$${capability_set}:[[:space:]]*//p" /proc/self/status)" == 0000000000000000 ]] || exit 1; done; for descriptor in /proc/self/fd/*; do [[ ! -e "$$descriptor" || "$${descriptor##*/}" =~ ^[012]$$ ]] || exit 1; done; standard_output="$$(/usr/bin/readlink -- /proc/$$$$/fd/1)"; [[ "$$(/usr/bin/readlink -- /proc/$$$$/fd/0)" == /dev/null && "$$standard_output" =~ ^pipe:\[[0-9]+\]$$ && "$$(/usr/bin/readlink -- /proc/$$$$/fd/2)" == "$$standard_output" ]] || exit 1; for descriptor in 0 1 2; do descriptor_flags="$$(/usr/bin/sed -n "s/^flags:[[:space:]]*//p" "/proc/$$$$/fdinfo/$$descriptor")"; expected_access="$$((descriptor == 0 ? 0 : 1))"; [[ "$$((8#$$descriptor_flags & 3))" == "$$expected_access" ]] || exit 1; done; for ipc_table in msg sem shm; do [[ -z "$$(/usr/bin/sed -n "2p" "/proc/sysvipc/$$ipc_table")" ]] || exit 1; done; ! /usr/bin/head -c 1 -- "$$3/Makefile" >/dev/null 2>&1 || exit 1; [[ $$$$ == 1 && $$PPID == 0 && "$$(/usr/bin/id -u)" == "$$1" && "$$(/usr/bin/id -g)" == "$$2" && "$$(/usr/bin/hostname)" == orange-gate && "$$(/usr/bin/readlink -- /proc/self/ns/ipc)" != "$$6" && "$$(/usr/bin/readlink -- /proc/self/ns/uts)" != "$$7" && "$$HOME" == "$$4" && "$$PATH" == "$$5/toolchain/bin:/usr/bin:/bin" && "$$(/usr/bin/sed -n "s/^NoNewPrivs:[[:space:]]*//p" /proc/self/status)" == 1 && -z "$$(/usr/bin/sed -n "2p" /proc/net/route)" ]]' gate-isolation "$$gate_uid" "$$gate_gid" "$$repository_root" "$$cargo_home/home" "$$gate_tools" "$$gate_ipc_namespace" "$$gate_uts_namespace"; \
+	run_cargo /bin/bash --norc -p -c 'for capability_set in CapInh CapPrm CapEff CapBnd CapAmb; do [[ "$$(/usr/bin/sed -n "s/^$${capability_set}:[[:space:]]*//p" /proc/self/status)" == 0000000000000000 ]] || exit 1; done; for descriptor in /proc/self/fd/*; do [[ ! -e "$$descriptor" || "$${descriptor##*/}" =~ ^[012]$$ ]] || exit 1; done; standard_output="$$(/usr/bin/readlink -- /proc/$$$$/fd/1)"; [[ "$$(/usr/bin/readlink -- /proc/$$$$/fd/0)" == /dev/null && "$$standard_output" =~ ^pipe:\[[0-9]+\]$$ && "$$(/usr/bin/readlink -- /proc/$$$$/fd/2)" == "$$standard_output" ]] || exit 1; for descriptor in 0 1 2; do descriptor_flags="$$(/usr/bin/sed -n "s/^flags:[[:space:]]*//p" "/proc/$$$$/fdinfo/$$descriptor")"; expected_access="$$((descriptor == 0 ? 0 : 1))"; [[ "$$((8#$$descriptor_flags & 3))" == "$$expected_access" ]] || exit 1; done; for ipc_table in msg sem shm; do [[ -z "$$(/usr/bin/sed -n "2p" "/proc/sysvipc/$$ipc_table")" ]] || exit 1; done; ! /usr/bin/head -c 1 -- "$$3/Makefile" >/dev/null 2>&1 || exit 1; ! /usr/bin/head -c 1 -- /etc/passwd >/dev/null 2>&1 || exit 1; ! /usr/bin/head -c 1 -- /sys/devices/system/cpu/online >/dev/null 2>&1 || exit 1; [[ $$$$ == 1 && $$PPID == 0 && "$$(/usr/bin/id -u)" == "$$1" && "$$(/usr/bin/id -g)" == "$$2" && "$$(/usr/bin/hostname)" == orange-gate && "$$(/usr/bin/readlink -- /proc/self/ns/ipc)" != "$$6" && "$$(/usr/bin/readlink -- /proc/self/ns/uts)" != "$$7" && "$$HOME" == "$$4" && "$$PATH" == "$$5/toolchain/bin:/usr/bin:/bin" && "$$(/usr/bin/sed -n "s/^NoNewPrivs:[[:space:]]*//p" /proc/self/status)" == 1 && -z "$$(/usr/bin/sed -n "2p" /proc/net/route)" ]]' gate-isolation "$$gate_uid" "$$gate_gid" "$$repository_root" "$$cargo_home/home" "$$gate_tools" "$$gate_ipc_namespace" "$$gate_uts_namespace"; \
 	run_cargo /usr/bin/env PYTHONHASHSEED=0 /usr/bin/python3 -S -P -B -X utf8 -W error::ResourceWarning "$$cargo_home/check-src/tools/validate_foundation.py"; \
 	run_cargo /usr/bin/env PYTHONHASHSEED=0 PYTHONPYCACHEPREFIX="$$cargo_home/snapshot-python-cache" /usr/bin/python3 -S -P -B -X utf8 -W error::ResourceWarning -c 'import sys, unittest; sys.path.insert(0, sys.argv.pop(1)); unittest.main(module=None)' "$$cargo_home/check-src" discover -s "$$cargo_home/check-src/tools/tests" -p 'test_*.py'; \
 	run_cargo /usr/bin/env PYTHONHASHSEED=0 /usr/bin/python3 -S -P -B -X utf8 -W error::ResourceWarning "$$cargo_home/check-src/tools/validate_foundation.py"; \

compiler/README.md

@@ -73,19 +73,23 @@ empty route table.
 Before the drop, the namespace supervisor bind-mounts the selected toolchain
 read-only and covers `/home` with a private non-executable `tmpfs`. A protected C
 launcher built from the captured tree requires Landlock ABI 3 or newer, permits
-directory-name traversal but grants file reads and execution only to the system
-roots and selected toolchain, and grants writes only to the two gate roots and
-four admitted character devices. It also closes every inherited descriptor above
-standard error, resets ordinary catchable signal dispositions to default, and
-empties the ordinary signal mask before execution. The launcher also fixes hard
+directory-name traversal but grants file reads and execution only to `/usr`, the
+private `/proc`, the gate tool roots, and the selected toolchain, and grants
+writes only to the two gate roots and four admitted character devices. Host
+account/configuration files under `/etc` and kernel/device state under `/sys`
+remain unreadable, with representative runtime assertions. The launcher also
+closes every inherited descriptor above standard error, resets ordinary
+catchable signal dispositions to default, and empties the ordinary signal mask
+before execution. The launcher also fixes hard
 ceilings of 4 GiB of virtual address space and 600 CPU seconds per process,
 512 MiB per file, 1,024 open files, 256 processes for the real user, and zero
 core-file bytes, preserving any lower inherited hard ceiling. Copied commands
-receive isolated `HOME`, `TMPDIR`, and `PATH` values; a runtime assertion
-confirms that the original checkout is unreadable. The namespace supervisor
-kills its child if supervision is interrupted. Trusted gate operations alone
-retain the descriptors used for later extraction and identity checks. The copied
-validator first policy-checks
+receive isolated `HOME`, `TMPDIR`, and `PATH` values, disable system Git
+configuration, and bind global Git configuration to `/dev/null`; a runtime
+assertion confirms that the original checkout is unreadable. The namespace
+supervisor kills its child if supervision is interrupted. Trusted gate operations
+alone retain the descriptors used for later extraction and identity checks. The
+copied validator first policy-checks
 that exact exported tree before its foundation test modules import.
 After those tests, it policy-checks the tree again before Cargo, so Python-test
 drift cannot reach Rust execution. Formatting, linting, documentation, and Rust
@@ -111,7 +115,8 @@ trusted outer `/usr/bin/cat` relays that merged stream to the caller's final
 output sink. The caller can still close or truncate that final sink, and the two
 copied output channels are intentionally indistinguishable. The system C
 compiler, launcher source, relay, kernel, mount implementation, and allowlisted
-system trees remain trusted boundaries. Resource ceilings are not aggregate
+system roots remain trusted boundaries. Private `/proc` still exposes kernel,
+CPU, and process metadata. Resource ceilings are not aggregate
 cgroup budgets: virtual address space and CPU time are limited per process,
 file size is limited per file, aggregate resident memory is not capped, and the
 process ceiling includes other processes with the same real user ID.

docs/operations/CI_DEPENDENCIES.md

@@ -279,7 +279,7 @@ recorded identities and digests.
 
 | Result | What is currently fixed | What the result actually establishes | Why it is not reproducible evidence yet |
 | --- | --- | --- | --- |
-| `scripts/ci/check-repository` | Repository bytes, Cargo lock, selected Rust version, allowlisted Python and Cargo environments, fresh bytecode/build cache roots, private mount, PID, `/proc`, network, IPC, and UTS namespaces with asserted distinct identities, a fixed gate hostname, a read-only selected-toolchain bind, hidden `/home`, a protected Landlock allowlist, default ordinary catchable signal dispositions, an empty ordinary signal mask, read-only null standard input, a merged write-only copied-command output pipe with a trusted outer relay, and hard copied-command ceilings of 4 GiB of virtual address space and 600 CPU seconds per process, 512 MiB per file, 1,024 open files, 256 real-user processes, and zero core bytes; the gate uses an unprivileged user namespace where available or a privilege-dropping namespace supervisor otherwise, removes all five capability sets, closes nonstandard descriptors, and runs Cargo locked/offline | Rust formatting, lint, docs, debug and optimized unit/CLI tests, repository invariants, and synthetic/adversarial fixture expectations pass under the executing toolchain and OS without copied-code file contents outside admitted roots, trusted-parent process visibility, inherited host System V IPC objects, the host hostname, inherited blocked `SIGTERM` or ignored `SIGPIPE`, inherited nonstandard descriptors, caller-supplied standard-input bytes, direct access to caller output descriptors, unbounded single-process address-space reservation, unbounded single-process CPU time, unbounded single-file growth, Linux capabilities, privilege-reacquisition permission, or a new external network path | Rust archives, C compiler, Python, shell, Make, kernel, Landlock, namespace and privilege-drop implementations, filesystem, output relay, and host tools are not content-fixed; directory names and unmediated metadata operations remain visible, libc-reserved signal state remains platform-dependent, copied commands can alter their own signal state after execution, the caller controls and can close or truncate the relay's final output sink, resource ceilings are not aggregate cgroup budgets and do not cap aggregate resident memory, and no signed execution manifest or independently replayable environment is emitted |
+| `scripts/ci/check-repository` | Repository bytes, Cargo lock, selected Rust version, allowlisted Python and Cargo environments, fresh bytecode/build cache roots, disabled system Git configuration, global Git configuration fixed to `/dev/null`, private mount, PID, `/proc`, network, IPC, and UTS namespaces with asserted distinct identities, a fixed gate hostname, a read-only selected-toolchain bind, hidden `/home`, a protected Landlock allowlist that omits `/etc` and `/sys`, default ordinary catchable signal dispositions, an empty ordinary signal mask, read-only null standard input, a merged write-only copied-command output pipe with a trusted outer relay, and hard copied-command ceilings of 4 GiB of virtual address space and 600 CPU seconds per process, 512 MiB per file, 1,024 open files, 256 real-user processes, and zero core bytes; the gate uses an unprivileged user namespace where available or a privilege-dropping namespace supervisor otherwise, removes all five capability sets, closes nonstandard descriptors, and runs Cargo locked/offline | Rust formatting, lint, docs, debug and optimized unit/CLI tests, repository invariants, and synthetic/adversarial fixture expectations pass under the executing toolchain and OS without copied-code file contents outside admitted roots, host account/configuration file contents, sysfs kernel/device contents, caller-selected system/global Git configuration, trusted-parent process visibility, inherited host System V IPC objects, the host hostname, inherited blocked `SIGTERM` or ignored `SIGPIPE`, inherited nonstandard descriptors, caller-supplied standard-input bytes, direct access to caller output descriptors, unbounded single-process address-space reservation, unbounded single-process CPU time, unbounded single-file growth, Linux capabilities, privilege-reacquisition permission, or a new external network path | Rust archives, C compiler, Python, shell, Make, kernel, Landlock, namespace and privilege-drop implementations, filesystem, output relay, and host tools are not content-fixed; directory names, private-`/proc` kernel/CPU/process metadata, and unmediated metadata operations remain visible, libc-reserved signal state remains platform-dependent, copied commands can alter their own signal state after execution, the caller controls and can close or truncate the relay's final output sink, resource ceilings are not aggregate cgroup budgets and do not cap aggregate resident memory, and no signed execution manifest or independently replayable environment is emitted |
 | Required hosted CI | Repository revision, direct Action SHAs, actionlint archive digest, and zizmor image digest | The configured repository, Markdown, workflow, and workflow-security methods passed in one hosted run | Runner image, Node, Git, Docker host, Action bundles, and service behavior are not fully archived or fixed |
 | Dependency Review | Event base/head identities and the selected Action revision | GitHub reported no configured dependency-policy violation for its then-current dependency data | Dependency graph/API state and service implementation are external, time-indexed inputs |
 | External Links | lychee archive digest, link-check flags, and repository locators | The non-excluded endpoints produced accepted responses during the run | Remote content, DNS, TLS, routing, rate limits, and server policy change independently of repository bytes |