pwn 0.5.725 → 0.5.728

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3ada4e79d8d8864ce2ea48b7378b4d10e124e7925d050424d3ef10e269438d5f
-  data.tar.gz: 714c044b1ab48bf33ca175d73fee3997d0788ed9d34e6c124d59c7fdf630c01e
+  metadata.gz: '0018be9794020a4b996e0d67a076e2741ca124d475f1439a047a77ecc0667d9d'
+  data.tar.gz: 46eae2746ab67af7ace35e7dc4caa6e09897a187ec7295a6fe5b103a33262722
 SHA512:
-  metadata.gz: 2472a6aa034cd281f4b2b67804558b7f40827abfca843857b7f713d1c492a9ea1e3c2bfd03282134bc2d2270e1db77cdc7c20876b0f4baf58d5b36c929ba536f
-  data.tar.gz: e7550328388a59e8d4047bceef0da28446850c2b0d40670930e104ea3ca7a89559aa65db510bd2d2e60f02053f85a98890a5bd96fee7d0435d1a53c845a5fe44
+  metadata.gz: dd8e061914bb0941234e210a8ea346d4f11dbd0babcd5137e93fe529b094826459b469f6cfb5d2e8cabdc306bbb8471df5703275035a9e8d27fc36352b50ec84
+  data.tar.gz: 4f361334ec04c20998333623be5c2d5b97ab27189dc52f1d4fda470ff40e743c38f58b1ae37b85244557a1f7eaf93954abd3baafdcb96c8bc8d57eb4fc71ff98

data/Gemfile

@@ -88,7 +88,7 @@ gem 'ruby-audio', '1.6.1'
 gem 'ruby-nmap', '1.0.3'
 gem 'ruby-saml', '1.18.1'
 gem 'rvm', '1.11.3.9'
-gem 'savon', '2.17.4'
+gem 'savon', '2.17.5'
 gem 'selenium-devtools', '0.153.0'
 gem 'selenium-webdriver', '4.49.0'
 gem 'slack-ruby-client', '3.2.0'

data/bin/pwn-capd

@@ -1,5 +1,14 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-# Packaging-compatible driver; privileged deployments execute daemon.py directly.
-exec('/usr/bin/python3', '-I', File.expand_path('../lib/pwn/plugins/capability_broker/daemon.py', __dir__), *ARGV)
+# Deploy the reviewed Ruby library tree with this executable, never setcap Ruby.
+$LOAD_PATH.unshift(File.expand_path('../lib', __dir__))
+require 'pwn'
+require 'pwn/plugins/capability_broker/daemon'
+
+begin
+  PWN::Plugins::CapabilityBroker::Daemon.main(argv: ARGV)
+rescue StandardError => e
+  warn "pwn-capd: #{e.message}"
+  exit 1
+end

data/documentation/Capability-Broker-Sandbox.md

@@ -2,7 +2,12 @@
 
 ## pwn-capd (P8)
 
-The Python stdlib helper speaks one bounded JSON request per Unix connection.
+The native Ruby helper speaks one bounded JSON request per Unix connection.
+Ruby `Socket` and `pack` implement AF_PACKET send/capture and pcap encoding;
+the existing `ffi` gem calls Linux libc `prctl`, `capget` and `capset`.
+There is no Python runtime or fallback. Read-only ARP/ND queries retain the
+`/usr/sbin/ip` (iproute2) dependency, executed as an argument vector with a
+clean environment, bounded output and a five-second deadline.
 Linux SO_PEERCRED authenticates the configured caller UID; the client also
 checks the daemon UID. The socket is mode 0600. Only explicitly configured
 interfaces are accepted. Operations: `status`, `raw_send` (base64 Ethernet
@@ -11,10 +16,32 @@ neighbor-cache queries). There is no command endpoint, arbitrary privileged
 output path, firewall mutation, or implicit sudo. ARP/ND currently query cache;
 they do not actively solicit neighbors or mutate entries.
 
-Operator installation (NOT executed by the application): install
-`lib/pwn/plugins/capability_broker/daemon.py` (not the Ruby packaging driver)
-root-owned under `/usr/local/libexec/pwn-capd`, mode 0755, in a root-owned
-non-writable directory. Do **not** setcap the system Ruby/Python interpreter
+Requests are limited to 100,000 bytes including the newline; each connection
+has a 35-second total deadline. Ethernet sends accept 14..65,535 decoded bytes.
+Captures accept 1..128 packets, at most 30 seconds, and 4,096 bytes per packet.
+The helper sets `no_new_privs`, intersects effective/permitted capabilities
+with CAP_NET_RAW/CAP_NET_ADMIN, and clears both inheritable words before
+handling requests. It never adds a capability. Existing socket paths (including
+symlinks) and writable or foreign-owned socket directories are refused.
+
+Unprivileged protocol and native-executable smoke (no raw packets or privilege grants):
+
+```
+bundle exec rspec spec/lib/pwn/plugins/capability_broker_spec.rb spec/lib/pwn/plugins/capability_broker/daemon_spec.rb
+```
+
+Operator installation (NOT executed by the application): install the reviewed
+PWN Ruby package and its dependencies root-owned, including `bin/pwn-capd`,
+`lib/pwn/plugins/capability_broker.rb` and
+`lib/pwn/plugins/capability_broker/daemon.rb`. Keep the package's `bin/` and
+`lib/` layout intact; point the service ExecStart at that package's
+`bin/pwn-capd`. A root-managed installed-gem executable may also be exposed
+as `/usr/local/libexec/pwn-capd` (mode 0755). The executable, library tree,
+Ruby interpreter, gems and all ancestor directories must be administrator
+controlled and non-writable by clients. Clear user-controlled `RUBYOPT`,
+`RUBYLIB`, `GEM_HOME`, `GEM_PATH` and Bundler environment settings in the
+service; use only the reviewed installation's dependency paths.
+Do **not** setcap the shared Ruby interpreter
 or this script: Linux ignores script file capabilities, and granting a shared
 interpreter network privileges exposes every script. Use a dedicated systemd
 service with `User=<operator>`,  `AmbientCapabilities=CAP_NET_RAW CAP_NET_ADMIN`,
@@ -60,7 +87,9 @@ PWN::Plugins::Sandbox.rollback(snapshot: s[:snapshot], backend: 'bwrap')
 ```
 
 Docker is default, image `pwn-sandbox:local`; it must be provisioned locally,
-with `/usr/bin/python3`, strace, GDB, and target runtime libraries. No implicit
+with `/usr/bin/ruby`, strace, GDB, and target runtime libraries. The controller
+and isolated worker use Ruby stdlib only; no Python interpreter is launched by
+the sandbox driver (GDB itself may include Python support). No implicit
 pull, installation, daemon startup or host-execution fallback occurs. Use the
 included `lib/pwn/plugins/sandbox/Dockerfile` to build explicitly. Network none,
 read-only root/artifacts, unprivileged UID, all caps dropped, no-new-privileges,
@@ -84,13 +113,23 @@ Fuzzing is bounded seeded bit-flip stdin mutation, not coverage-guided AFL.
 Tools register via `require 'pwn/ai/agent/tools/sandbox'`: `sandbox_run` and
 `sandbox_fuzz`; normal Registry discovery finds that file.
 
-Verification:
+Sandbox verification (safe bwrap fixtures require working unprivileged namespaces):
 ```
-bundle exec rspec spec/lib/pwn/plugins/{packet,capability_broker,sandbox}_spec.rb
-python3 spec/lib/pwn/plugins/capd_test.py
-python3 spec/lib/pwn/plugins/sandbox_test.py
+bundle exec rspec spec/lib/pwn/plugins/sandbox_spec.rb spec/lib/pwn/plugins/sandbox/driver_spec.rb
 ```
 
+The tests exercise `/bin/true`, read-only mounts, namespace isolation without
+network requests, timeouts, resource limits, SIGSEGV/GDB/strace replay,
+byte-exact stdin mutation and snapshot integrity. Docker command/cleanup unit
+checks are not evidence of a running Docker backend. The GDB fixture requests
+1024 MiB: this host's GDB can exhaust the default 256 MiB address-space budget.
+Instrumentation failures retain raw output and an unknown classification.
+
+Fuzz seeds are reproducible within this Ruby implementation, not bit-for-bit
+compatible with Python's PRNG sequence. Each iteration retains the execution
+and replay budget plus bounded backend startup/cleanup overhead; the minutes
+budget stops starting new iterations, rather than preempting cleanup.
+
 Safe real Docker smoke after explicit provisioning:
 ```
 bundle exec ruby -Ilib -rpwn/plugins/sandbox -e 'p PWN::Plugins::Sandbox.run(binary: "/bin/true")'

data/documentation/LoRaPHY-LICENSE.txt

@@ -0,0 +1,25 @@
+LoRa PHY coding equations in lib/pwn/sdr/decoder/lora.rb are adapted from
+https://github.com/jkadbear/LoRaPHY/blob/4fddd9a7b47682781c663608bfc4f196e4bf656d/LoRaPHY.m
+
+The MIT License (MIT)
+
+Copyright (C) 2020-2022 jkadbear, jkadbear@gmail.com
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.