@glassmkr/crucible 0.13.15 → 0.13.16

package/dist/lib/__tests__/capability.test.js

@@ -1,56 +1,68 @@
 import { describe, it, expect } from "vitest";
-import { detectIpmiCapability, formatCapabilityLine } from "../capability.js";
+import { detectIpmiCapability, formatCapabilityLine, isIpmitoolVersionVulnerable, } from "../capability.js";
+describe("isIpmitoolVersionVulnerable (CVE-2020-5208, fixed in 1.8.19)", () => {
+    it("flags versions strictly below 1.8.19", () => {
+        expect(isIpmitoolVersionVulnerable("1.8.18")).toBe(true);
+        expect(isIpmitoolVersionVulnerable("1.8.11")).toBe(true);
+        expect(isIpmitoolVersionVulnerable("1.7.99")).toBe(true);
+    });
+    it("clears 1.8.19 and above", () => {
+        expect(isIpmitoolVersionVulnerable("1.8.19")).toBe(false);
+        expect(isIpmitoolVersionVulnerable("1.8.20")).toBe(false);
+        expect(isIpmitoolVersionVulnerable("1.9.0")).toBe(false);
+        expect(isIpmitoolVersionVulnerable("2.0.0")).toBe(false);
+    });
+    it("does not gate an unknown/unparseable version (fail-open on identification)", () => {
+        expect(isIpmitoolVersionVulnerable(null)).toBe(false);
+        expect(isIpmitoolVersionVulnerable("")).toBe(false);
+        expect(isIpmitoolVersionVulnerable("unknown")).toBe(false);
+    });
+    it("tolerates distro version suffixes", () => {
+        expect(isIpmitoolVersionVulnerable("1.8.18-11ubuntu2")).toBe(true);
+        expect(isIpmitoolVersionVulnerable("1.8.19-4")).toBe(false);
+    });
+});
 describe("detectIpmiCapability", () => {
     it("returns no_ipmitool_binary when neither device nor binary exist (Pi)", async () => {
         const cap = await detectIpmiCapability({
-            statDevice: async () => "enoent",
             runIpmitool: async () => { const e = new Error("not found"); e.code = "ENOENT"; throw e; },
+            probeSensor: async () => null,
         });
         expect(cap).toEqual({ available: false, reason: "no_ipmitool_binary" });
     });
-    it("returns available when /dev/ipmi0 exists and ipmitool runs", async () => {
+    it("available when the WRAPPED sensor probe returns BMC data (CVE-safe version)", async () => {
+        // §2.1: availability comes from the wrapper (runs as root), not a direct
+        // /dev/ipmi0 stat the unprivileged service user can't do.
         const cap = await detectIpmiCapability({
-            statDevice: async (p) => p === "/dev/ipmi0" ? "ok" : "enoent",
-            runIpmitool: async () => ({ stdout: "ipmitool version 1.8.18\n", stderr: "" }),
+            runIpmitool: async () => ({ stdout: "ipmitool version 1.8.19\n", stderr: "" }),
+            probeSensor: async () => "CPU Temp | 39.000 | degrees C | ok",
         });
-        expect(cap).toEqual({ available: true, method: "ipmitool_in_band", ipmitool_version: "1.8.18" });
+        expect(cap).toEqual({ available: true, method: "ipmitool_in_band", ipmitool_version: "1.8.19" });
     });
-    it("returns no_bmc_device when ipmitool exists but device is missing AND sensor probe fails", async () => {
+    it("disables IPMI when ipmitool is below 1.8.19 even if the BMC answers (CVE-2020-5208)", async () => {
         const cap = await detectIpmiCapability({
-            statDevice: async () => "enoent",
-            runIpmitool: async (args) => {
-                if (args[0] === "-V")
-                    return { stdout: "ipmitool version 1.8.18", stderr: "" };
-                const e = new Error("Could not open device");
-                e.stderr = "Could not open device at /dev/ipmi0: No such file or directory";
-                throw e;
-            },
+            runIpmitool: async () => ({ stdout: "ipmitool version 1.8.18\n", stderr: "" }),
+            probeSensor: async () => "CPU Temp | 39.000 | degrees C | ok",
         });
         expect(cap.available).toBe(false);
-        if (!cap.available)
-            expect(cap.reason).toBe("no_bmc_device");
+        if (!cap.available) {
+            expect(cap.reason).toBe("ipmitool_cve_2020_5208");
+            expect(cap.detail).toContain("1.8.18");
+        }
     });
-    it("returns permission_denied on EACCES", async () => {
+    it("no_bmc_device when the wrapped sensor probe returns nothing (no BMC / VM)", async () => {
         const cap = await detectIpmiCapability({
-            statDevice: async () => "eacces",
-            runIpmitool: async () => ({ stdout: "ipmitool version 1.8.18", stderr: "" }),
+            runIpmitool: async () => ({ stdout: "ipmitool version 1.8.19", stderr: "" }),
+            probeSensor: async () => null,
         });
         expect(cap.available).toBe(false);
-        if (!cap.available) {
-            expect(cap.reason).toBe("permission_denied");
-            expect(cap.detail).toContain("ipmi");
-        }
+        if (!cap.available)
+            expect(cap.reason).toBe("no_bmc_device");
     });
-    it("VM with ipmitool installed but no virtual BMC: no_bmc_device", async () => {
+    it("no_bmc_device on empty (whitespace-only) sensor output", async () => {
         const cap = await detectIpmiCapability({
-            statDevice: async () => "enoent",
-            runIpmitool: async (args) => {
-                if (args[0] === "-V")
-                    return { stdout: "ipmitool version 1.8.19", stderr: "" };
-                const e = new Error("could not open");
-                e.stderr = "Could not open device";
-                throw e;
-            },
+            runIpmitool: async () => ({ stdout: "ipmitool version 1.8.19", stderr: "" }),
+            probeSensor: async () => "   \n  ",
         });
         expect(cap.available).toBe(false);
         if (!cap.available)
@@ -58,8 +70,8 @@ describe("detectIpmiCapability", () => {
     });
     it("captures ipmitool version when present", async () => {
         const cap = await detectIpmiCapability({
-            statDevice: async (p) => p === "/dev/ipmi0" ? "ok" : "enoent",
             runIpmitool: async () => ({ stdout: "ipmitool version 1.8.21-rc1\n", stderr: "" }),
+            probeSensor: async () => "CPU Temp | 39.000 | degrees C | ok",
         });
         expect(cap.available).toBe(true);
         if (cap.available)

package/dist/lib/__tests__/capability.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"capability.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/capability.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ;YAChC,WAAW,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,CAAC,GAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SAChG,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAC7D,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ;YAChC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC1B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;gBAC/E,MAAM,CAAC,GAAQ,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBAClD,CAAC,CAAC,MAAM,GAAG,gEAAgE,CAAC;gBAC5E,MAAM,CAAC,CAAC;YACV,CAAC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ;YAChC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;SAC7E,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ;YAChC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC1B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;gBAC/E,MAAM,CAAC,GAAQ,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBAC3C,CAAC,CAAC,MAAM,GAAG,uBAAuB,CAAC;gBACnC,MAAM,CAAC,CAAC;YACV,CAAC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;YAC7D,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;SACnF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC;aACtG,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;aAC7E,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACxB,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;aACxE,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;aAC/G,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"capability.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/capability.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAE1B,QAAQ,CAAC,8DAA8D,EAAE,GAAG,EAAE;IAC5E,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,2BAA2B,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,WAAW,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,CAAC,GAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC/F,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC9E,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,oCAAoC;SAC9D,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC9E,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,oCAAoC;SAC9D,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC5E,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAC5E,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;YACrC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YAClF,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,oCAAoC;SAC9D,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,CAAC;aACtG,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;aAC7E,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACxB,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;aACxE,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;aAC/G,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/__tests__/privileged.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/__tests__/privileged.test.js

@@ -0,0 +1,110 @@
+import { describe, it, expect } from "vitest";
+import { isAllowedSmartDevice, isAllowedIface, WRAPPER_SCRIPT, SUDOERS_CONTENT, WRAPPER_PATH, SUDOERS_PATH, SERVICE_USER, } from "../privileged.js";
+import { setupPrivilegeSeparation } from "../../init.js";
+function mockDeps(execImpl) {
+    const files = new Map();
+    const warns = [];
+    const deps = {
+        fs: {
+            existsSync: (p) => files.has(p),
+            mkdirSync: () => { },
+            writeFileSync: (p, data, o) => { files.set(p, { data, mode: o?.mode ?? 0o644 }); },
+            chmodSync: (p, mode) => { const f = files.get(p); if (f)
+                f.mode = mode; },
+            renameSync: (from, to) => {
+                const f = files.get(from);
+                if (!f)
+                    throw new Error(`ENOENT: ${from}`);
+                files.set(to, f);
+                files.delete(from);
+            },
+        },
+        exec: execImpl,
+        hostname: () => "h", log: () => { }, warn: (m) => warns.push(m), error: () => { },
+        fetch: async () => ({ status: 200 }), readStdin: async () => "",
+    };
+    return { deps, files, warns };
+}
+// A fresh box: `id glassmkr` fails (user absent), everything else succeeds.
+const okExec = (cmd) => cmd === "id"
+    ? { stdout: "", status: 1 }
+    : { stdout: "", status: 0 };
+describe("setupPrivilegeSeparation", () => {
+    it("succeeds on a clean box: creates user, installs wrapper 0755 + sudoers 0440", () => {
+        const { deps, files } = mockDeps(okExec);
+        expect(setupPrivilegeSeparation(deps, "/etc/glassmkr/crucible.yaml")).toBe(true);
+        expect(files.get(WRAPPER_PATH)?.mode).toBe(0o755);
+        expect(files.get(SUDOERS_PATH)?.mode).toBe(0o440);
+        expect(files.has(`${SUDOERS_PATH}.tmp`)).toBe(false); // renamed, not left behind
+    });
+    it("fail-safe: visudo rejection returns false and never installs the sudoers file", () => {
+        const { deps, files } = mockDeps((cmd) => cmd === "id" ? { stdout: "", status: 1 } :
+            cmd === "visudo" ? { stdout: "", status: 1 } :
+                { stdout: "", status: 0 });
+        expect(setupPrivilegeSeparation(deps, "/etc/glassmkr/crucible.yaml")).toBe(false);
+        expect(files.has(SUDOERS_PATH)).toBe(false);
+    });
+    it("fail-safe: useradd failure returns false (caller keeps User=root)", () => {
+        const { deps } = mockDeps((cmd) => cmd === "id" ? { stdout: "", status: 1 } :
+            cmd === "useradd" ? { stdout: "", status: 1 } :
+                { stdout: "", status: 0 });
+        expect(setupPrivilegeSeparation(deps, "/etc/glassmkr/crucible.yaml")).toBe(false);
+    });
+});
+describe("isAllowedSmartDevice", () => {
+    it("accepts real block/nvme device nodes", () => {
+        for (const d of ["/dev/sda", "/dev/sdb", "/dev/sdaa", "/dev/hda", "/dev/nvme0n1", "/dev/nvme12n3", "/dev/nvme0", "/dev/bus/0"]) {
+            expect(isAllowedSmartDevice(d)).toBe(true);
+        }
+    });
+    it("rejects traversal, injection, and non-device paths", () => {
+        for (const d of ["/etc/shadow", "/dev/../etc/shadow", "/dev/sda; rm -rf /", "/dev/sda foo", "", "sda", "/dev/sda\n/dev/sdb", "/dev/mapper/x"]) {
+            expect(isAllowedSmartDevice(d)).toBe(false);
+        }
+    });
+});
+describe("isAllowedIface", () => {
+    it("accepts real interface names", () => {
+        for (const i of ["eth0", "enp1s0", "eno1", "bond0", "bond0.100", "br-lan", "en_p0"]) {
+            expect(isAllowedIface(i)).toBe(true);
+        }
+    });
+    it("rejects empty, over-long, spaced, and injection-y names", () => {
+        for (const i of ["", "a".repeat(16), "eth0 x", "eth0;rm", "../eth0", "eth0|cat", "$(id)"]) {
+            expect(isAllowedIface(i)).toBe(false);
+        }
+    });
+});
+describe("WRAPPER_SCRIPT (the sudo facade)", () => {
+    it("is POSIX sh with strict mode", () => {
+        expect(WRAPPER_SCRIPT.startsWith("#!/bin/sh")).toBe(true);
+        expect(WRAPPER_SCRIPT).toContain("set -eu");
+    });
+    it("has no argument passthrough sink ($@ / $* into a command)", () => {
+        // The only $-expansions should be the validated $dev / $ifc / $action /
+        // ${#1}. A bare exec of "$@" or "$*" would be a passthrough hole.
+        expect(WRAPPER_SCRIPT).not.toMatch(/exec[^\n]*"\$@"/);
+        expect(WRAPPER_SCRIPT).not.toMatch(/exec[^\n]*\$\*/);
+    });
+    it("validates the two parameterised actions before exec", () => {
+        expect(WRAPPER_SCRIPT).toContain("valid_device");
+        expect(WRAPPER_SCRIPT).toContain("valid_iface");
+    });
+    it("hard-codes the expected privileged commands", () => {
+        expect(WRAPPER_SCRIPT).toContain("exec ipmitool sensor");
+        expect(WRAPPER_SCRIPT).toContain("exec smartctl --json --all");
+        expect(WRAPPER_SCRIPT).toContain("exec zpool status");
+        expect(WRAPPER_SCRIPT).toContain("exec iptables -L -n");
+    });
+});
+describe("SUDOERS_CONTENT", () => {
+    it("grants only the wrapper, NOPASSWD, to the service user", () => {
+        expect(SUDOERS_CONTENT).toContain(`${SERVICE_USER} ALL=(root) NOPASSWD: ${WRAPPER_PATH}`);
+    });
+    it("contains no wildcard and resets the environment", () => {
+        expect(SUDOERS_CONTENT).not.toContain("*");
+        expect(SUDOERS_CONTENT).toContain("env_reset");
+        expect(SUDOERS_CONTENT).toContain("secure_path");
+    });
+});
+//# sourceMappingURL=privileged.test.js.map

package/dist/lib/__tests__/privileged.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privileged.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/privileged.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,wBAAwB,EAAiB,MAAM,eAAe,CAAC;AAIxE,SAAS,QAAQ,CAAC,QAAkB;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAa;QACrB,EAAE,EAAE;YACF,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,SAAS,EAAE,GAAG,EAAE,GAAE,CAAC;YACnB,aAAa,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAClF,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;YACzE,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;gBACvB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAAC,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;gBACtE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;SACF;QACD,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;QAC/E,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;KAChE,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,4EAA4E;AAC5E,MAAM,MAAM,GAAa,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI;IAC5C,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE;IAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAE9B,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,2BAA2B;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE,CACvC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1C,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9C,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE,CAChC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1C,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC/C,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;YAC/H,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,eAAe,CAAC,EAAE,CAAC;YAC9I,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YACpF,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1F,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACzD,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAC/D,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,GAAG,YAAY,yBAAyB,YAAY,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/capability.d.ts

@@ -4,17 +4,32 @@ export type IpmiCapability = {
     ipmitool_version: string | null;
 } | {
     available: false;
-    reason: "no_ipmitool_binary" | "no_bmc_device" | "execution_failed" | "permission_denied";
+    reason: "no_ipmitool_binary" | "no_bmc_device" | "execution_failed" | "permission_denied" | "ipmitool_cve_2020_5208";
     detail?: string;
 };
+export declare const MIN_SAFE_IPMITOOL_VERSION = "1.8.19";
+/**
+ * True iff `version` is a parseable ipmitool version strictly below
+ * MIN_SAFE_IPMITOOL_VERSION. Unknown/unparseable versions return false
+ * (we do not disable a capability we cannot positively identify as
+ * vulnerable). Pure; unit-tested.
+ */
+export declare function isIpmitoolVersionVulnerable(version: string | null): boolean;
 interface DetectDeps {
-    /** Override for tests. Returns "ok" | "enoent" | "eacces" per path. */
-    statDevice?: (path: string) => Promise<"ok" | "enoent" | "eacces">;
-    /** Override for tests. Returns stdout or throws with err.code. */
+    /** Override for tests. Runs `ipmitool -V` (direct; works unprivileged).
+     *  Returns stdout or throws with err.code. Used only for the version /
+     *  CVE gate. */
     runIpmitool?: (args: string[]) => Promise<{
         stdout: string;
         stderr: string;
     }>;
+    /** Override for tests. The WRAPPED sensor probe (`sudo crucible-collect
+     *  ipmi-sensor`). Returns stdout, or null on any failure. This is the
+     *  availability signal: under the §2.1 unprivileged model the agent user
+     *  cannot stat /dev/ipmi0 or run ipmitool directly, so a direct
+     *  device-node probe is meaningless; the wrapper (which runs as root) is
+     *  the real reachability test. */
+    probeSensor?: () => Promise<string | null>;
 }
 export declare function detectIpmiCapability(deps?: DetectDeps): Promise<IpmiCapability>;
 export declare function formatCapabilityLine(cap: IpmiCapability): string;

package/dist/lib/capability.js

@@ -8,50 +8,49 @@
 //
 // This module probes once at startup and caches the result. collectIpmi()
 // reads the cached capability and short-circuits when unavailable.
-import { promises as fs } from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { runPrivileged } from "./privileged.js";
 const execFileAsync = promisify(execFile);
-const DEVICE_CANDIDATES = ["/dev/ipmi0", "/dev/ipmi/0", "/dev/ipmidev/0"];
-async function defaultStatDevice(path) {
-    try {
-        await fs.access(path, fs.constants.R_OK);
-        return "ok";
-    }
-    catch (err) {
-        if (err.code === "EACCES" || err.code === "EPERM")
-            return "eacces";
-        return "enoent";
+// CVE-2020-5208 (GHSA-g659-9qxw-p7cp): heap overflow in ipmitool's
+// read_fru_area_section and related parsers when handling data received
+// from a remote LAN party (a malicious or compromised BMC). Fixed in
+// ipmitool 1.8.19. The agent runs ipmitool in-band against the host BMC,
+// so a compromised BMC parsing path is a real local-blast-radius primitive
+// (audit §2.1 / catalog T-202). Below the fix version we mark IPMI
+// unavailable rather than feed BMC output to a vulnerable parser.
+export const MIN_SAFE_IPMITOOL_VERSION = "1.8.19";
+/**
+ * True iff `version` is a parseable ipmitool version strictly below
+ * MIN_SAFE_IPMITOOL_VERSION. Unknown/unparseable versions return false
+ * (we do not disable a capability we cannot positively identify as
+ * vulnerable). Pure; unit-tested.
+ */
+export function isIpmitoolVersionVulnerable(version) {
+    if (!version)
+        return false;
+    const min = [1, 8, 19];
+    const parts = version.split(/[.\-+]/).map((p) => parseInt(p, 10));
+    if (parts.length === 0 || Number.isNaN(parts[0]))
+        return false; // unparseable
+    for (let i = 0; i < min.length; i++) {
+        const p = Number.isNaN(parts[i]) ? 0 : (parts[i] ?? 0);
+        if (p < min[i])
+            return true;
+        if (p > min[i])
+            return false;
     }
+    return false; // equal or greater
 }
 async function defaultRunIpmitool(args) {
     const { stdout, stderr } = await execFileAsync("ipmitool", args, { timeout: 2000 });
     return { stdout, stderr };
 }
 export async function detectIpmiCapability(deps = {}) {
-    const statDevice = deps.statDevice ?? defaultStatDevice;
     const runIpmitool = deps.runIpmitool ?? defaultRunIpmitool;
-    // Step 1: probe /dev/ipmi* device nodes.
-    let deviceFound = false;
-    let permissionDenied = false;
-    for (const path of DEVICE_CANDIDATES) {
-        const result = await statDevice(path);
-        if (result === "ok") {
-            deviceFound = true;
-            break;
-        }
-        if (result === "eacces") {
-            permissionDenied = true;
-        }
-    }
-    if (permissionDenied && !deviceFound) {
-        return {
-            available: false,
-            reason: "permission_denied",
-            detail: "/dev/ipmi0 exists but is not readable; run as root or add user to ipmi group",
-        };
-    }
-    // Step 2: probe ipmitool binary.
+    const probeSensor = deps.probeSensor ?? (() => runPrivileged("ipmi-sensor"));
+    // Step 1: probe the ipmitool binary + version. `ipmitool -V` needs no BMC
+    // access, so it works even as the unprivileged service user.
     let ipmitoolVersion = null;
     try {
         const { stdout } = await runIpmitool(["-V"]);
@@ -68,26 +67,28 @@ export async function detectIpmiCapability(deps = {}) {
             detail: String(err?.stderr ?? err?.message ?? err).split("\n")[0]?.slice(0, 200),
         };
     }
-    // Step 3: device + binary present → assume capable.
-    if (deviceFound) {
-        return { available: true, method: "ipmitool_in_band", ipmitool_version: ipmitoolVersion };
+    // Step 2: version gate (CVE-2020-5208): refuse to feed BMC output to a
+    // vulnerable ipmitool parser. Fail-closed for the IPMI capability only;
+    // every other collector is unaffected. Skipped when the version could
+    // not be parsed (we do not disable a capability we cannot positively
+    // identify as vulnerable).
+    if (isIpmitoolVersionVulnerable(ipmitoolVersion)) {
+        return {
+            available: false,
+            reason: "ipmitool_cve_2020_5208",
+            detail: `ipmitool ${ipmitoolVersion} < ${MIN_SAFE_IPMITOOL_VERSION}; upgrade to close CVE-2020-5208`,
+        };
     }
-    // Step 4: binary present but no device node — try one sensor probe to
-    // disambiguate (some kernels expose IPMI through unconventional paths).
+    // Step 3: reachability via the WRAPPED sensor probe. Non-empty output means
+    // the BMC answered; empty/failure means no usable BMC on this host.
     try {
-        const { stdout, stderr } = await runIpmitool(["sensor"]);
-        const out = stdout || "";
-        const errOut = (stderr || "").toLowerCase();
-        if (out.trim().length > 0 && !errOut.includes("could not open")) {
+        const out = await probeSensor();
+        if (out && out.trim().length > 0) {
             return { available: true, method: "ipmitool_in_band", ipmitool_version: ipmitoolVersion };
         }
         return { available: false, reason: "no_bmc_device" };
     }
     catch (err) {
-        const stderr = String(err?.stderr ?? "").toLowerCase();
-        if (stderr.includes("could not open")) {
-            return { available: false, reason: "no_bmc_device" };
-        }
         return {
             available: false,
             reason: "execution_failed",
@@ -105,6 +106,7 @@ export function formatCapabilityLine(cap) {
         case "no_bmc_device": return "IPMI: not available (no /dev/ipmi*, BMC not detected)";
         case "permission_denied": return `IPMI: not available (${cap.detail ?? "permission denied"})`;
         case "execution_failed": return `IPMI: not available (execution failed${cap.detail ? `: ${cap.detail}` : ""})`;
+        case "ipmitool_cve_2020_5208": return `IPMI: disabled (${cap.detail ?? "ipmitool too old (CVE-2020-5208)"})`;
     }
 }
 //# sourceMappingURL=capability.js.map

package/dist/lib/capability.js.map

@@ -1 +1 @@
-{"version":3,"file":"capability.js","sourceRoot":"","sources":["../../src/lib/capability.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AAEnE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAM1C,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAS1E,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAc;IAC9C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAmB,EAAE;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAE3D,yCAAyC;IACzC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAAC,WAAW,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;QACnD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAAC,gBAAgB,GAAG,IAAI,CAAC;QAAC,CAAC;IACvD,CAAC;IAED,IAAI,gBAAgB,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,8EAA8E;SACvF,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACjD,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACjF,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;IAC5F,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACvD,CAAC;QACD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,oBAAoB,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC;IAClE,CAAC;IACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,oBAAoB,CAAC,CAAC,OAAO,8CAA8C,CAAC;QACjF,KAAK,eAAe,CAAC,CAAM,OAAO,uDAAuD,CAAC;QAC1F,KAAK,mBAAmB,CAAC,CAAE,OAAO,wBAAwB,GAAG,CAAC,MAAM,IAAI,mBAAmB,GAAG,CAAC;QAC/F,KAAK,kBAAkB,CAAC,CAAG,OAAO,wCAAwC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IACnH,CAAC;AACH,CAAC"}
+{"version":3,"file":"capability.js","sourceRoot":"","sources":["../../src/lib/capability.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,mEAAmE;AAEnE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAM1C,mEAAmE;AACnE,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,2EAA2E;AAC3E,mEAAmE;AACnE,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAElD;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAsB;IAChE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,cAAc;IAC9E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,mBAAmB;AACnC,CAAC;AAgBD,KAAK,UAAU,kBAAkB,CAAC,IAAc;IAC9C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAmB,EAAE;IAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;IAE7E,0EAA0E;IAC1E,6DAA6D;IAC7D,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACjD,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACjF,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,2BAA2B;IAC3B,IAAI,2BAA2B,CAAC,eAAe,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,YAAY,eAAe,MAAM,yBAAyB,kCAAkC;SACrG,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,oEAAoE;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,EAAE,CAAC;QAChC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,oBAAoB,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC;IAClE,CAAC;IACD,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,oBAAoB,CAAC,CAAC,OAAO,8CAA8C,CAAC;QACjF,KAAK,eAAe,CAAC,CAAM,OAAO,uDAAuD,CAAC;QAC1F,KAAK,mBAAmB,CAAC,CAAE,OAAO,wBAAwB,GAAG,CAAC,MAAM,IAAI,mBAAmB,GAAG,CAAC;QAC/F,KAAK,kBAAkB,CAAC,CAAG,OAAO,wCAAwC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;QACjH,KAAK,wBAAwB,CAAC,CAAC,OAAO,mBAAmB,GAAG,CAAC,MAAM,IAAI,kCAAkC,GAAG,CAAC;IAC/G,CAAC;AACH,CAAC"}

package/dist/lib/privileged.d.ts

@@ -0,0 +1,22 @@
+export declare const SERVICE_USER = "glassmkr";
+export declare const WRAPPER_PATH = "/usr/local/sbin/crucible-collect";
+export declare const SUDOERS_PATH = "/etc/sudoers.d/glassmkr-crucible";
+export type PrivilegedAction = "ipmi-sensor" | "ipmi-sel-info" | "ipmi-sel-elist" | "ipmi-fan" | "smart" | "zpool" | "raid-perccli" | "raid-storcli" | "raid-ssacli" | "raid-arcconf" | "dmesg-errcrit" | "dmesg-io" | "iptables" | "nft" | "ufw" | "firewall-cmd" | "pve-firewall" | "sshd" | "lvs" | "ethtool" | "last";
+/** SMART device paths the wrapper accepts. Mirrors the sh `valid_device`
+ *  case in WRAPPER_SCRIPT; kept in TS so it is unit-testable. Blocks path
+ *  traversal / arbitrary-file reads via `smartctl -a <path>`. */
+export declare function isAllowedSmartDevice(dev: string): boolean;
+/** ethtool interface names the wrapper accepts. Linux ifnames are <=15
+ *  chars from a restricted set; no slashes/spaces so no arg injection. */
+export declare function isAllowedIface(name: string): boolean;
+/**
+ * Invoke a privileged collection action through the sudo wrapper. Returns
+ * the command stdout, or null on any failure (wrapper/sudoers not installed,
+ * tool absent, non-zero exit) - callers already treat null as "capability
+ * unavailable", so a missing wrapper degrades gracefully rather than
+ * crashing. When the agent still runs as root (pre-migration or old installs)
+ * `sudo -n` simply runs the wrapper without a password prompt.
+ */
+export declare function runPrivileged(action: PrivilegedAction, args?: string[], timeoutMs?: number): Promise<string | null>;
+export declare const WRAPPER_SCRIPT = "#!/bin/sh\n# Glassmkr Crucible privileged-collection facade (audit \u00A72.1).\n# Installed root:root 0755. The sole sudo grant for the unprivileged\n# 'glassmkr' service user. Fixed action -> fixed argv; no passthrough.\n# Managed by glassmkr-crucible init; do not edit by hand.\nset -eu\n\naction=\"${1:-}\"\n[ -n \"$action\" ] || { echo \"crucible-collect: missing action\" >&2; exit 64; }\nshift 2>/dev/null || true\n\nvalid_device() {\n  case \"$1\" in\n    /dev/sd[a-z]|/dev/sd[a-z][a-z]|/dev/hd[a-z]|/dev/hd[a-z][a-z]) return 0 ;;\n    /dev/nvme[0-9]*n[0-9]*|/dev/nvme[0-9]*) return 0 ;;\n    /dev/bus/[0-9]*) return 0 ;;\n    *) return 1 ;;\n  esac\n}\nvalid_iface() {\n  case \"$1\" in\n    \"\" | *[!A-Za-z0-9._:-]*) return 1 ;;\n    *) [ \"${#1}\" -le 15 ] ;;\n  esac\n}\n\ncase \"$action\" in\n  ipmi-sensor)    exec ipmitool sensor ;;\n  ipmi-sel-info)  exec ipmitool sel info ;;\n  ipmi-sel-elist) exec ipmitool sel elist ;;\n  ipmi-fan)       exec ipmitool sdr type Fan ;;\n  smart)\n    dev=\"${1:-}\"\n    valid_device \"$dev\" || { echo \"crucible-collect: rejected device: $dev\" >&2; exit 65; }\n    exec smartctl --json --all \"$dev\" ;;\n  zpool)          exec zpool status ;;\n  raid-perccli)   exec perccli /c0 show all J ;;\n  raid-storcli)   exec storcli /call show all J ;;\n  raid-ssacli)    exec ssacli ctrl all show status ;;\n  raid-arcconf)   exec arcconf list ;;\n  dmesg-errcrit)  exec dmesg --level=err,crit --since \"5 min ago\" ;;\n  dmesg-io)       exec sh -c 'dmesg -T --since \"10 minutes ago\" 2>/dev/null | grep -i \"I/O error\\\\|Buffer I/O error\\\\|blk_update_request.*error\"' ;;\n  iptables)       exec iptables -L -n ;;\n  nft)            exec nft list ruleset ;;\n  ufw)            exec ufw status ;;\n  firewall-cmd)   exec firewall-cmd --state ;;\n  pve-firewall)   exec pve-firewall status ;;\n  sshd)           exec sshd -T ;;\n  lvs)            exec lvs --reportformat=json --options=lv_name,vg_name,lv_attr,data_percent,metadata_percent --units=b --noheadings ;;\n  ethtool)\n    ifc=\"${1:-}\"\n    valid_iface \"$ifc\" || { echo \"crucible-collect: rejected iface: $ifc\" >&2; exit 65; }\n    exec ethtool \"$ifc\" ;;\n  last)           exec last -x -F ;;\n  *) echo \"crucible-collect: unknown action: $action\" >&2; exit 64 ;;\nesac\n";
+export declare const SUDOERS_CONTENT = "# Glassmkr Crucible (audit \u00A72.1). Managed by glassmkr-crucible init.\n# The service user may run ONLY the fixed-argv collection facade as root.\nDefaults!/usr/local/sbin/crucible-collect env_reset\nDefaults!/usr/local/sbin/crucible-collect secure_path=\"/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin\"\nglassmkr ALL=(root) NOPASSWD: /usr/local/sbin/crucible-collect\n";

package/dist/lib/privileged.js

@@ -0,0 +1,117 @@
+// Privileged-collection facade (security audit §2.1).
+//
+// Crucible historically ran as root so every collector could invoke
+// ipmitool / smartctl / zpool / dmesg / etc. directly. That makes the whole
+// collection runtime a root-blast-radius surface (catalog T-201/T-202/T-208).
+//
+// This module is the boundary that lets the agent run as an unprivileged
+// `glassmkr` service user instead: it gains hardware/kernel read access ONLY
+// by invoking a single root-owned wrapper via `sudo -n`. The wrapper
+// (`/usr/local/sbin/crucible-collect`) dispatches a FIXED action name to a
+// hard-coded argv - there is no argument passthrough, so it is not the
+// "sudo <binary> $@" anti-pattern. The only variable inputs (a SMART device
+// path and an ethtool interface name) are validated against strict allowlists
+// in the wrapper before exec.
+//
+// A single dispatcher (rather than one script per binary) is deliberate: it
+// is one small file to audit and one sudoers line, and every privileged
+// command is visible in one `case` statement. The wrapper is installed
+// root:root 0755 (not writable by `glassmkr`) so the sudo grant cannot be
+// hijacked by tampering with the script.
+import { run } from "./exec.js";
+export const SERVICE_USER = "glassmkr";
+export const WRAPPER_PATH = "/usr/local/sbin/crucible-collect";
+export const SUDOERS_PATH = "/etc/sudoers.d/glassmkr-crucible";
+/** SMART device paths the wrapper accepts. Mirrors the sh `valid_device`
+ *  case in WRAPPER_SCRIPT; kept in TS so it is unit-testable. Blocks path
+ *  traversal / arbitrary-file reads via `smartctl -a <path>`. */
+export function isAllowedSmartDevice(dev) {
+    return /^\/dev\/(sd[a-z]+|hd[a-z]+|nvme\d+(n\d+)?|bus\/\d+)$/.test(dev);
+}
+/** ethtool interface names the wrapper accepts. Linux ifnames are <=15
+ *  chars from a restricted set; no slashes/spaces so no arg injection. */
+export function isAllowedIface(name) {
+    return name.length > 0 && name.length <= 15 && /^[A-Za-z0-9._:-]+$/.test(name);
+}
+/**
+ * Invoke a privileged collection action through the sudo wrapper. Returns
+ * the command stdout, or null on any failure (wrapper/sudoers not installed,
+ * tool absent, non-zero exit) - callers already treat null as "capability
+ * unavailable", so a missing wrapper degrades gracefully rather than
+ * crashing. When the agent still runs as root (pre-migration or old installs)
+ * `sudo -n` simply runs the wrapper without a password prompt.
+ */
+export function runPrivileged(action, args = [], timeoutMs = 10000) {
+    return run("sudo", ["-n", WRAPPER_PATH, action, ...args], timeoutMs);
+}
+// The wrapper script, written verbatim to WRAPPER_PATH by init. POSIX sh.
+// Every case `exec`s a fixed command; the two parameterised cases validate
+// their single argument first. Keep the `valid_device` / `valid_iface` cases
+// in sync with the TS validators above.
+export const WRAPPER_SCRIPT = `#!/bin/sh
+# Glassmkr Crucible privileged-collection facade (audit §2.1).
+# Installed root:root 0755. The sole sudo grant for the unprivileged
+# 'glassmkr' service user. Fixed action -> fixed argv; no passthrough.
+# Managed by glassmkr-crucible init; do not edit by hand.
+set -eu
+
+action="\${1:-}"
+[ -n "$action" ] || { echo "crucible-collect: missing action" >&2; exit 64; }
+shift 2>/dev/null || true
+
+valid_device() {
+  case "$1" in
+    /dev/sd[a-z]|/dev/sd[a-z][a-z]|/dev/hd[a-z]|/dev/hd[a-z][a-z]) return 0 ;;
+    /dev/nvme[0-9]*n[0-9]*|/dev/nvme[0-9]*) return 0 ;;
+    /dev/bus/[0-9]*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+valid_iface() {
+  case "$1" in
+    "" | *[!A-Za-z0-9._:-]*) return 1 ;;
+    *) [ "\${#1}" -le 15 ] ;;
+  esac
+}
+
+case "$action" in
+  ipmi-sensor)    exec ipmitool sensor ;;
+  ipmi-sel-info)  exec ipmitool sel info ;;
+  ipmi-sel-elist) exec ipmitool sel elist ;;
+  ipmi-fan)       exec ipmitool sdr type Fan ;;
+  smart)
+    dev="\${1:-}"
+    valid_device "$dev" || { echo "crucible-collect: rejected device: $dev" >&2; exit 65; }
+    exec smartctl --json --all "$dev" ;;
+  zpool)          exec zpool status ;;
+  raid-perccli)   exec perccli /c0 show all J ;;
+  raid-storcli)   exec storcli /call show all J ;;
+  raid-ssacli)    exec ssacli ctrl all show status ;;
+  raid-arcconf)   exec arcconf list ;;
+  dmesg-errcrit)  exec dmesg --level=err,crit --since "5 min ago" ;;
+  dmesg-io)       exec sh -c 'dmesg -T --since "10 minutes ago" 2>/dev/null | grep -i "I/O error\\\\|Buffer I/O error\\\\|blk_update_request.*error"' ;;
+  iptables)       exec iptables -L -n ;;
+  nft)            exec nft list ruleset ;;
+  ufw)            exec ufw status ;;
+  firewall-cmd)   exec firewall-cmd --state ;;
+  pve-firewall)   exec pve-firewall status ;;
+  sshd)           exec sshd -T ;;
+  lvs)            exec lvs --reportformat=json --options=lv_name,vg_name,lv_attr,data_percent,metadata_percent --units=b --noheadings ;;
+  ethtool)
+    ifc="\${1:-}"
+    valid_iface "$ifc" || { echo "crucible-collect: rejected iface: $ifc" >&2; exit 65; }
+    exec ethtool "$ifc" ;;
+  last)           exec last -x -F ;;
+  *) echo "crucible-collect: unknown action: $action" >&2; exit 64 ;;
+esac
+`;
+// The sudoers drop-in. Grants the service user NOPASSWD on the single
+// wrapper only, with env_reset + a fixed secure_path. No wildcards. Written
+// 0440 root:root and validated with `visudo -cf` before install.
+export const SUDOERS_CONTENT = `# Glassmkr Crucible (audit §2.1). Managed by glassmkr-crucible init.
+# The service user may run ONLY the fixed-argv collection facade as root.
+Defaults!${WRAPPER_PATH} env_reset
+Defaults!${WRAPPER_PATH} secure_path="/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin"
+${SERVICE_USER} ALL=(root) NOPASSWD: ${WRAPPER_PATH}
+`;
+//# sourceMappingURL=privileged.js.map

package/dist/lib/privileged.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privileged.js","sourceRoot":"","sources":["../../src/lib/privileged.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,8EAA8E;AAC9E,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,qEAAqE;AACrE,2EAA2E;AAC3E,uEAAuE;AACvE,4EAA4E;AAC5E,8EAA8E;AAC9E,8BAA8B;AAC9B,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AACxE,uEAAuE;AACvE,0EAA0E;AAC1E,yCAAyC;AAEzC,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhC,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AACvC,MAAM,CAAC,MAAM,YAAY,GAAG,kCAAkC,CAAC;AAC/D,MAAM,CAAC,MAAM,YAAY,GAAG,kCAAkC,CAAC;AAa/D;;iEAEiE;AACjE,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,sDAAsD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAwB,EACxB,OAAiB,EAAE,EACnB,SAAS,GAAG,KAAK;IAEjB,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,6EAA6E;AAC7E,wCAAwC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwD7B,CAAC;AAEF,sEAAsE;AACtE,4EAA4E;AAC5E,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG;;WAEpB,YAAY;WACZ,YAAY;EACrB,YAAY,yBAAyB,YAAY;CAClD,CAAC"}