pwn 0.5.787 → 0.5.790

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce00a627ad7114375ec35258f45bd003f3fb0799851af992d5a1031d59d1a2d6
-  data.tar.gz: 6687afae44eb7e95191584266cc65c09033c68cc42c0b649091dcc6e7ff269d4
+  metadata.gz: 43bc28ac60d5883af330355e4b3c12a7d0b8d553f194021a934eab172efe0d51
+  data.tar.gz: b2c8133b2a5fd7a7be73e2245df3a6e2a35e5eb6319cde8676b109f9b423577a
 SHA512:
-  metadata.gz: 23d19fc265c256a615ec04fc1f6772f7c3924ffad70e94b8725afadba0651319610e4cf2fbfb57803122e3ca7e69cbd01f9517292414b9294538661f8d84fe58
-  data.tar.gz: 476d7566a80d68b207d3c2e947bcba724251ad4adee393a5dca8992e52ed8953f8dc8f4f9b7ad7358c7eb8514db4c787739e25786d1b3206bf036e76ba31cc12
+  metadata.gz: 316290237f20ebf205c02adcada75525462ac152d9c8ce0db918ac87b7d17457b8d1461c81bfad3cf19fc5bb649a6dfec5c05bed384e4389e2dcf19a9985267d
+  data.tar.gz: 99d090c82e60a2641cf1c53b0a54a4ce09d7cede595d9c03d9958861ab48785a8022e17184bc3fd9b9ec935149477180dbf531668e60695005a7dde3d4001d80

data/documentation/Backup-Retention.md

@@ -34,12 +34,16 @@ Maintenance still defers when the Learning writer is busy.
 
 Before a new folder is admitted, oldest completed generations may be expired
 to make room. That includes a capture pin that is not listed in the retention
-policy and not named by current evidence. Prepared/interrupted generations,
-retention-policy pins and current literal evidence references remain protected.
-Malformed reference data fails closed when expiry would be needed. If those
-protected folders occupy the seven-folder limit, the next producer fails before
-modifying its source. Unknown legacy folders count toward capacity but are not
-silently certified or expired.
+policy and not named by current evidence. It also includes a published
+pre-generation snapshot named `YYYYMMDD_HHMMSS` or `YYYYMMDD_HHMMSS_<8 hex>`
+that has no interrupted generation record, and an unpublished `.partial-`
+copy that was never renamed into a restore name. Those are not certified as
+complete; they are only eligible so one verified snapshot can be published.
+Prepared/interrupted generations, retention-policy pins and current literal
+evidence references remain protected. Malformed reference data fails closed
+when expiry would be needed. If those protected folders occupy the seven-folder
+limit, the next producer fails before modifying its source. Unknown folder
+names still count toward capacity and are not silently expired.
 
 Transactions publish `prepared` before payload/source changes and `complete`
 only after successful return. Exceptions, interrupted/blocked results and failed

data/lib/pwn/backups.rb

@@ -12,6 +12,10 @@ module PWN
   module Backups
     LIMIT = 7
     GENERATION = /\A\d{8}_\d{6}_[a-f0-9]{8}\z/
+    # Published Migrate.backup! names from before .generation.json. Not an unknown folder.
+    LEGACY_SNAPSHOT = /\A\d{8}_\d{6}\z/
+    # Unpublished housekeeping-era copy. Rename was the publish step, so this is not a restore name.
+    PARTIAL_SNAPSHOT = /\A\.partial-\d{8}_\d{6}(?:_[a-f0-9]{8})?\z/
 
     # Supported Method Parameters::
     # PWN::Backups.active?
@@ -69,23 +73,13 @@ module PWN
         pins = names.length >= LIMIT ? reference_pins(root: root) : []
         raise IOError, 'Pinned backup missing' unless (pins - names).empty?
 
-        candidates = names.select do |name|
-          next false unless name.match?(GENERATION) && !pins.include?(name)
-
-          path = File.join(root, name)
-          safe_directory(path: path)
-          state = File.join(path, '.generation.json')
-          next false unless File.file?(state) && !File.symlink?(state)
-
-          record = JSON.parse(File.binread(state))
-          # Capture pins that nothing references may be expired. Policy pins and
-          # evidence references are already in `pins`. Interrupted generations are not.
-          record['version'] == 1 && record['state'] == 'complete'
-        end
+        candidates = names.select { |name| expirable_name?(name: name, root: root, pins: pins) }
         count = [names.length - LIMIT + 1, 0].max
         raise IOError, 'Backup capacity occupied by legacy, pinned or interrupted generations' if candidates.length < count
 
-        candidates.sort_by { |name| File.mtime(File.join(root, name)).to_r }.first(count).each { |name| FileUtils.remove_entry_secure(File.join(root, name)) }
+        candidates.sort_by { |name| [File.mtime(File.join(root, name)).to_r, name] }.first(count).each do |name|
+          FileUtils.remove_entry_secure(File.join(root, name))
+        end
         context[:directory] = File.join(root, "#{Time.now.utc.strftime('%Y%m%d_%H%M%S')}_#{SecureRandom.hex(4)}")
         Dir.mkdir(context[:directory], 0o700)
         write_state(context: context, state: 'prepared')
@@ -285,6 +279,44 @@ module PWN
       raise IOError, "Unreadable backup references: #{e.class}"
     end
 
+    # Unreferenced complete generations, published pre-generation snapshots, and
+    # unpublished partials may be expired. Policy pins, evidence references,
+    # interrupted generations, and unknown folder names may not.
+    private_class_method def self.expirable_name?(opts = {})
+      name = opts[:name].to_s
+      root = opts[:root]
+      return false if opts[:pins].include?(name)
+
+      path = File.join(root, name)
+      return false unless owned_directory?(path: path)
+      return true if name.match?(PARTIAL_SNAPSHOT)
+      return false unless name.match?(GENERATION) || name.match?(LEGACY_SNAPSHOT)
+
+      state = File.join(path, '.generation.json')
+      return true unless File.exist?(state) || File.symlink?(state)
+      return false unless File.file?(state) && !File.symlink?(state)
+
+      record = JSON.parse(File.binread(state))
+      record.is_a?(Hash) && record['version'] == 1 && record['state'] == 'complete'
+    rescue JSON::ParserError
+      false
+    end
+
+    private_class_method def self.owned_directory?(opts = {})
+      path = opts[:path]
+      ancestor = path
+      loop do
+        return false if File.symlink?(ancestor)
+        break if File.dirname(ancestor) == ancestor
+
+        ancestor = File.dirname(ancestor)
+      end
+      stat = File.stat(path)
+      stat.directory? && stat.uid == Process.uid
+    rescue SystemCallError
+      false
+    end
+
     private_class_method def self.safe_directory(opts = {})
       path = opts[:path]
       ancestor = path

data/lib/pwn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PWN
-  VERSION = '0.5.787'
+  VERSION = '0.5.790'
 end

data/spec/lib/pwn/ai/agent/mission_namespace_spec.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
+require 'open3'
 require 'tmpdir'
 
 RSpec.describe 'PWN::AI::Agent::MissionNamespace compiler-free process ownership' do
@@ -12,6 +13,16 @@ RSpec.describe 'PWN::AI::Agent::MissionNamespace compiler-free process ownership
     PWN::AI::Agent::MissionNamespace.force_exec = previous
   end
 
+  it 'does not ask newuidmap for a host uid range starting at 0' do
+    source = File.read(File.expand_path('../../../../support/mission_namespace.rb', __dir__))
+    pid_token = ['#', '{pid}'].join
+    expect(source).not_to include('--map-users=0:0:65536')
+    expect(source).to include("/proc/#{pid_token}/uid_map")
+    expect(source.index('Process.groups = []')).to be < source.index("/proc/#{pid_token}/setgroups")
+    expect(source).to include('exit! status')
+    expect(source).not_to match(/^\s*exit status\b/)
+  end
+
   it 'loads through root and direct requires without suppressing sibling autoloads' do
     %w[pwn pwn/ai/agent/mission_namespace].each do |entry|
       code = <<~RUBY

data/spec/lib/pwn/backups_spec.rb

@@ -49,6 +49,9 @@ describe PWN::Backups do
 
   it 'pins actual evidence paths but not quoted inventory prose' do
     copies = 7.times.map { described_class.capture(path: @source) }
+    generations = copies.map { |path| File.dirname(path, 2) }
+    generations.each_with_index { |dir, index| File.utime(Time.at(1_700_000_100 + index), Time.at(1_700_000_100 + index), dir) }
+    File.utime(Time.at(1_700_000_000), Time.at(1_700_000_000), generations[1])
     File.write(File.join(@home, '.pwn', 'learning.jsonl'), JSON.generate(evidence_path: copies.first, prose: "old path #{copies[1]}"))
     described_class.capture(path: @source)
     expect(File).to exist(copies.first)
@@ -119,6 +122,67 @@ describe PWN::Backups do
     expect(File.read(result[:moved].fetch(legacy))).to eq('legacy bytes')
   end
 
+  it 'expires an unreferenced legacy timestamp snapshot and keeps a referenced one' do
+    root = File.join(@home, '.pwn', 'backup')
+    FileUtils.mkdir_p(root)
+    dirs = 7.times.map do |index|
+      dir = File.join(root, format('2020010%d_000000', index + 1))
+      FileUtils.mkdir_p(dir)
+      File.write(File.join(dir, 'learning.jsonl'), "legacy-#{index}")
+      File.utime(Time.at(1_600_000_000 + index), Time.at(1_600_000_000 + index), dir)
+      dir
+    end
+    File.write(File.join(@home, '.pwn', 'learning.jsonl'), JSON.generate(evidence_path: "#{dirs.last}/learning.jsonl"))
+    described_class.capture(path: @source, label: 'migration')
+    expect(File).not_to exist(dirs.first)
+    expect(File).to exist(dirs.last)
+    expect(Dir.children(root).count { |name| File.directory?(File.join(root, name)) }).to eq(7)
+  end
+
+  it 'expires an unreferenced pre-generation hex snapshot that has no generation record' do
+    root = File.join(@home, '.pwn', 'backup')
+    FileUtils.mkdir_p(root)
+    dirs = 7.times.map do |index|
+      hex = (index + 1).to_s(16).rjust(8, '0')
+      dir = File.join(root, "2020020#{index + 1}_000000_#{hex}")
+      FileUtils.mkdir_p(dir)
+      File.utime(Time.at(1_600_000_100 + index), Time.at(1_600_000_100 + index), dir)
+      dir
+    end
+    described_class.capture(path: @source, label: 'migration')
+    expect(File).not_to exist(dirs.first)
+    expect(File).to exist(dirs.last)
+  end
+
+  it 'expires an unpublished partial copy that was never renamed into a restore name' do
+    root = File.join(@home, '.pwn', 'backup')
+    FileUtils.mkdir_p(root)
+    dirs = 7.times.map do |index|
+      dir = File.join(root, ".partial-2020040#{index + 1}_000000_abcd1234")
+      FileUtils.mkdir_p(dir)
+      File.utime(Time.at(1_600_000_200 + index), Time.at(1_600_000_200 + index), dir)
+      dir
+    end
+    described_class.capture(path: @source, label: 'migration')
+    expect(File).not_to exist(dirs.first)
+    expect(Dir.children(root).count { |name| File.directory?(File.join(root, name)) }).to eq(7)
+  end
+
+  it 'does not expire unknown folders or an interrupted legacy snapshot to free capacity' do
+    root = File.join(@home, '.pwn', 'backup')
+    unknown = 6.times.map do |index|
+      dir = File.join(root, "unknown-#{index}")
+      FileUtils.mkdir_p(dir)
+      dir
+    end
+    interrupted = File.join(root, '20200301_000000')
+    FileUtils.mkdir_p(interrupted)
+    File.write(File.join(interrupted, '.generation.json'), JSON.generate(version: 1, state: 'prepared', pinned: false))
+    expect { described_class.capture(path: @source) }.to raise_error(IOError, /capacity/)
+    expect(unknown.all? { |dir| File.directory?(dir) }).to be(true)
+    expect(File).to exist(interrupted)
+  end
+
   it 'tightens an owned group-writable backup directory before writing' do
     root = File.join(@home, '.pwn', 'backup')
     FileUtils.mkdir_p(root)

data/spec/lib/pwn/migrate_spec.rb

@@ -381,8 +381,42 @@ describe PWN::Migrate, 'backup housekeeping' do
     result = described_class.prune_backups(dry_run: false, keep: 3, expire_history: true)
     expect(result).to include(keep: 7, scope: 'global', deleted: [])
     expect(Dir.children(root).length).to eq(8)
-    expect { described_class.send(:backup!) }.to raise_error(IOError)
-    expect(Dir.children(root).grep(/\A\d/).length).to eq(8)
+  end
+
+  it 'expires oldest unreferenced legacy snapshots so migration can publish one verified generation' do
+    root = described_class::BACKUP_ROOT
+    dirs = 8.times.map do |i|
+      dir = File.join(root, format('2026010%d_000000', i + 1))
+      FileUtils.mkdir_p(dir)
+      File.write(File.join(dir, 'learning.jsonl'), "unique-#{i}")
+      File.utime(Time.at(1_700_000_000 + i), Time.at(1_700_000_000 + i), dir)
+      dir
+    end
+    path = described_class.send(:backup!)
+    expect(File).not_to exist(dirs[0])
+    expect(File).not_to exist(dirs[1])
+    expect(File).to exist(dirs.last)
+    expect(JSON.parse(File.binread(File.join(path, '.snapshot-manifest.json')))['complete']).to be(true)
+    expect(Dir.children(root).grep(/\A\d/).length).to eq(7)
+  end
+
+  it 'admits a schema migration snapshot when seven legacy timestamp folders already fill the store' do
+    root = described_class::BACKUP_ROOT
+    FileUtils.mkdir_p(root)
+    dirs = 7.times.map do |i|
+      dir = File.join(root, format('2025010%d_000000', i + 1))
+      FileUtils.mkdir_p(dir)
+      File.write(File.join(dir, 'learning.jsonl'), "legacy-#{i}")
+      File.utime(Time.at(1_700_100_000 + i), Time.at(1_700_100_000 + i), dir)
+      dir
+    end
+    File.write(described_class::SCHEMA_FILE, JSON.generate(schema: 11))
+    result = described_class.run(io: io)
+    expect(result[:applied_migrations]).to eq([12])
+    expect(result[:backup]).to be_a(String)
+    expect(File).not_to exist(dirs.first)
+    expect(File).to exist(File.join(result[:backup], '.snapshot-manifest.json'))
+    expect(Dir.children(root).count { |name| File.directory?(File.join(root, name)) }).to eq(7)
   end
 
   it 'publishes a verified scoped snapshot and fails closed on a copy failure' do

data/spec/lib/pwn/plugins/capability_broker/daemon_spec.rb

@@ -101,7 +101,15 @@ describe 'Native capability broker daemon' do
         Process.setpgrp
         begin
           if account
-            Process.groups = []
+            begin
+              Process.groups = []
+            rescue Errno::EPERM
+              # The root suite bootstrap denies setgroups before writing gid_map.
+              # That parent already cleared supplementary groups, so an empty set
+              # is success. A nonempty set is still a failed drop.
+              denied = File.file?('/proc/self/setgroups') && File.read('/proc/self/setgroups').strip == 'deny'
+              raise unless denied && Process.groups.empty?
+            end
             Process::GID.change_privilege(account.gid)
             Process::UID.change_privilege(account.uid)
             expect(Process.groups).to eq([])

data/spec/support/mission_namespace.rb

@@ -1,14 +1,74 @@
 # frozen_string_literal: true
 
+require 'fileutils'
+require 'tmpdir'
+
 # Unit fixtures contain Ruby closures/mocks that cannot cross exec. Bootstrap
 # ONLY the test runner into a real user namespace; every mission still creates
 # and reaps its own PID namespace. Exec integration fixtures force the production
 # descriptor path separately. No test flag disables kernel containment.
 # A root runner must map nobody. --map-current-user leaves only uid 0, and
 # chown/setuid to an unmapped account then fails with EINVAL.
-unless PWN::AI::Agent::MissionNamespace.prepared?
-  args = ['unshare', '--user', '--keep-caps']
-  args.push(Process.uid.zero? ? '--map-users=0:0:65536' : '--map-current-user')
-  args.push('--map-groups=0:0:65536') if Process.uid.zero?
-  exec(*args, RbConfig.ruby, '-I', $LOAD_PATH.join(File::PATH_SEPARATOR), $PROGRAM_NAME, *ARGV)
+# Do not ask unshare to map host uids 0-65535. That flag calls newuidmap, which
+# refuses the range unless /etc/subuid grants it. Root still has
+# CAP_SETUID in the parent namespace and writes the map itself.
+module PwnSpecNamespace
+  module_function
+
+  def bootstrap!
+    return if PWN::AI::Agent::MissionNamespace.prepared?
+
+    if Process.uid.zero?
+      bootstrap_root!
+    else
+      exec('unshare', '--user', '--keep-caps', '--map-current-user', RbConfig.ruby, '-I', $LOAD_PATH.join(File::PATH_SEPARATOR), $PROGRAM_NAME, *ARGV)
+    end
+  end
+
+  def bootstrap_root!
+    dir = nil
+    pid = nil
+    # setgroups deny is required before gid_map and then makes Process.groups=
+    # return EPERM for every process in the suite. Clear supplementary groups
+    # while this parent can still call setgroups. The unshare child inherits
+    # the empty set, which is the cleared state the smoke drop expects.
+    Process.groups = []
+    dir = Dir.mktmpdir('pwn-userns-')
+    File.chmod(0o1777, dir)
+    ready = File.join(dir, 'ready')
+    go = File.join(dir, 'go')
+    pid = Process.spawn(
+      { 'PWN_NS_READY' => ready, 'PWN_NS_GO' => go },
+      'unshare', '--user', '--keep-caps', '/bin/sh', '-c',
+      'touch "$PWN_NS_READY"; while [ ! -f "$PWN_NS_GO" ]; do sleep 0.05; done; exec "$@"',
+      'sh', RbConfig.ruby, '-I', $LOAD_PATH.join(File::PATH_SEPARATOR), $PROGRAM_NAME, *ARGV
+    )
+    deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 5
+    sleep 0.02 until File.exist?(ready) || Process.clock_gettime(Process::CLOCK_MONOTONIC) > deadline
+    raise 'root user-namespace bootstrap timed out before unshare' unless File.exist?(ready)
+
+    File.write("/proc/#{pid}/setgroups", 'deny')
+    File.write("/proc/#{pid}/gid_map", "0 0 65536\n")
+    File.write("/proc/#{pid}/uid_map", "0 0 65536\n")
+    File.write(go, "go\n")
+    Process.wait(pid)
+    status = Process.last_status.exitstatus || 1
+    pid = nil
+    # Kernel#exit raises SystemExit. RSpec rescues that while loading a spec
+    # and reports it as a load failure. exit! ends this parent with the child's
+    # status and does not raise. Clean the sync dir first; exit! skips ensure.
+    FileUtils.rm_rf(dir) if dir
+    dir = nil
+    exit! status
+  rescue StandardError
+    if pid
+      Process.kill('KILL', pid)
+      Process.wait(pid)
+    end
+    raise
+  ensure
+    FileUtils.rm_rf(dir) if dir && File.exist?(dir)
+  end
 end
+
+PwnSpecNamespace.bootstrap!

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pwn
 version: !ruby/object:Gem::Version
-  version: 0.5.787
+  version: 0.5.790
 platform: ruby
 authors:
 - 0day Inc.