Remove the residual root escalation left after the sudoers narrowing (TASK-445)

config/clawbox-root-manifest.sh

@@ -0,0 +1,204 @@
+#!/usr/bin/env bash
+#
+# Integrity manifest for the code root executes on the clawbox user's behalf.
+#
+# The privilege chain is:
+#
+#   clawbox  --sudo-->  systemctl start clawbox-root-update@<step>.service
+#            --systemd-->  /usr/local/libexec/clawbox/clawbox-root-step.sh (root:root)
+#            --exec-->     /home/clawbox/clawbox/install.sh --step <step>
+#
+# Only the middle link is root-owned. install.sh is `clawbox:clawbox 0755` in a
+# `clawbox:clawbox 0775` directory — install.sh itself hands the tree back with
+# `chown -R clawbox:clawbox` on every root run — and the steps it dispatches go
+# on to run more of the same tree as root (scripts/start-ap.sh,
+# scripts/launch-browser.sh, scripts/setup-hermes-edition.sh, …). So anything
+# with clawbox-level code execution — the web server, the in-UI terminal, the
+# agent's shell — could rewrite the program root was about to run and then
+# trigger a granted step. That is passwordless local root in two moves, and it
+# is the defect TASK-445 was filed about.
+#
+# Moving the tree out of clawbox's reach is not an option: the updater has to be
+# able to replace it, and the app has to be able to build in it. So instead the
+# root side REFUSES to run code it did not record. This file writes and checks
+# that record:
+#
+#   * install.sh writes the manifest at the end of every root-side install and
+#     immediately after every successful `git reset --hard` to the update branch
+#     (install.sh's bootstrap block and sync_repo_to_update_target). Those are
+#     the only two ways the covered files are supposed to change.
+#   * clawbox-root-step.sh verifies it before exec'ing anything. A tampered or
+#     unrecorded tree fails the step instead of running as root.
+#
+# What this does and does not buy:
+#
+#   * It closes the "rewrite install.sh, then start a granted unit" path — the
+#     dispatcher refuses before the exec.
+#   * It does NOT make the box safe against someone who can already run code as
+#     root, and it does not authenticate the UPDATE itself: an update legitimately
+#     replaces the covered files and re-records them. The update path is gated
+#     on the dashboard session instead (TASK-445's "require auth for update").
+#
+# Usage (root only):
+#   clawbox-root-manifest.sh --write     record the tree as it is now
+#   clawbox-root-manifest.sh --verify    exit 0 if it still matches, 65 if not
+#
+# Installed by install.sh::install_root_libexec to
+# /usr/local/libexec/clawbox/clawbox-root-manifest.sh, root:root 0755.
+
+set -euo pipefail
+
+# Hard-coded on purpose. Every value below selects WHICH code root executes, so
+# none of them is overridable from the environment: this script runs from a
+# systemd unit reached through a NOPASSWD sudoers grant, and an env escape hatch
+# would be a second way to point root at a file the clawbox user chose.
+PROJECT_DIR="/home/clawbox/clawbox"
+MANIFEST_DIR="/etc/clawbox"
+MANIFEST_FILE="/etc/clawbox/root-exec.manifest"
+
+# Everything the clawbox-root-update@ chain can end up running as root:
+# install.sh, the scripts it hands to bash, and the config/unit files it installs.
+# Runtime state — data/, .next/, node_modules/, .git/ — is deliberately NOT
+# covered: it is clawbox's to write and root never executes it, so covering it
+# would turn every build into a manifest mismatch.
+COVERED_PATHS="install.sh scripts config"
+
+# Generated content that lives INSIDE a covered path, and must not be recorded.
+# `scripts/__pycache__/` is the one that bites: gateway-pre-start.sh imports
+# scripts/gateway_origins.py, so CPython writes a .pyc there the first time the
+# gateway starts — after the manifest was written, and again under a different
+# name after any python3 minor-version bump. Recording those would make an
+# ordinary first boot, or an ordinary distro upgrade, refuse every root step.
+PRUNE_DIRS="__pycache__ node_modules .venv venv"
+
+die() {
+  echo "clawbox-root-manifest: $1" >&2
+  exit "${2:-65}"
+}
+
+# Covered files, relative to PROJECT_DIR, NUL-delimited and byte-sorted.
+# Callers must already be in PROJECT_DIR.
+#
+# `-type f` excludes symlinks deliberately: what gets RECORDED is a real file
+# and its real content. Verification then re-opens the recorded path, so
+# replacing one of these with a symlink to something else changes the hash and
+# fails — which is the answer we want, rather than recording the link.
+covered_files() {
+  local p
+  local -a args=() prune=()
+  for p in $COVERED_PATHS; do
+    [ -e "$p" ] && args+=("$p")
+  done
+  [ "${#args[@]}" -gt 0 ] || return 1
+  for p in $PRUNE_DIRS; do
+    prune+=(-name "$p" -prune -o)
+  done
+  find "${args[@]}" "${prune[@]}" -type f -print0 | LC_ALL=C sort -z
+}
+
+write_manifest() {
+  cd "$PROJECT_DIR" || die "$PROJECT_DIR is missing" 66
+
+  # ONE walk, so the names that are checked are exactly the names that are
+  # hashed. Walking twice — once to check, once to hash — leaves a window in
+  # which a file that appears in between is recorded without ever having been
+  # checked.
+  #
+  # The check itself: sha256sum ESCAPES a filename containing a backslash or a
+  # newline (it prefixes the line with `\` and re-encodes them), and
+  # verify_manifest reads the path column back with a fixed-width strip. Refuse
+  # to record such a name rather than record one this file cannot parse.
+  local f
+  local -a files=()
+  while IFS= read -r -d '' f; do
+    case "$f" in
+      *\\*|*$'\n'*)
+        die "refusing to record a path containing a backslash or a newline"
+        ;;
+    esac
+    files+=("$f")
+  done < <(covered_files)
+  [ "${#files[@]}" -gt 0 ] || die "nothing to record under $PROJECT_DIR" 66
+
+  install -d -o root -g root -m 0755 "$MANIFEST_DIR" || die "cannot create $MANIFEST_DIR" 66
+
+  # Staged inside the root-owned /etc/clawbox, never /tmp: a world-writable
+  # staging directory is one more place to race the file root ends up trusting.
+  local tmp
+  tmp="$(mktemp "$MANIFEST_FILE.XXXXXX")" || die "cannot stage a manifest" 66
+  if ! printf '%s\0' "${files[@]}" | xargs -0 sha256sum > "$tmp"; then
+    rm -f "$tmp"
+    die "cannot hash $PROJECT_DIR" 66
+  fi
+  if ! chmod 0644 "$tmp"; then
+    rm -f "$tmp"
+    die "cannot set the manifest mode" 66
+  fi
+  if ! mv -f "$tmp" "$MANIFEST_FILE"; then
+    rm -f "$tmp"
+    die "cannot install $MANIFEST_FILE" 66
+  fi
+}
+
+verify_manifest() {
+  [ -f "$MANIFEST_FILE" ] || die "no manifest at $MANIFEST_FILE"
+  cd "$PROJECT_DIR" || die "$PROJECT_DIR is missing" 66
+
+  # Every recorded file must still be there and still hash to what was recorded.
+  # That covers the three things that matter: an edited file, a deleted file, and
+  # a file replaced by a symlink (sha256sum opens the path, so it hashes what the
+  # link resolves to and the content stops matching).
+  #
+  # A file ADDED under a covered path is deliberately NOT an error, even though
+  # `sha256sum -c` cannot see it. Root only ever executes files install.sh names
+  # explicitly, and all of those are recorded — so an unrecorded file is not
+  # something root can be made to run. Treating additions as tampering, on the
+  # other hand, turns any stray file under scripts/ into a device that refuses
+  # every root step for good: no password change, no hostname change, no hotspot
+  # restart, on an appliance with no console. That trade is the wrong way round.
+  sha256sum --status --strict -c "$MANIFEST_FILE" \
+    || die "$PROJECT_DIR does not match $MANIFEST_FILE (a covered file changed or is gone)"
+}
+
+# Check ONE already-opened copy against what the manifest recorded for a path.
+#
+# `--verify` answers a question about the project tree, and the answer is stale
+# the moment it returns: the clawbox user can replace a file between the check
+# and the exec, and a tight rewrite loop wins that race. So the root dispatcher
+# copies the file it is going to run into a root-only directory FIRST and then
+# asks about the copy — which is the same bytes it will execute, and which
+# clawbox cannot touch.
+#
+#   clawbox-root-manifest.sh --verify-file <recorded path> <file to hash>
+verify_file() {
+  local rel="$1" actual="$2" want="" got h p
+  [ -n "$rel" ] && [ -n "$actual" ] || die "usage: $0 --verify-file <recorded path> <file>" 64
+  [ -f "$MANIFEST_FILE" ] || die "no manifest at $MANIFEST_FILE"
+  [ -f "$actual" ] || die "$actual is missing" 66
+
+  # Read the recorded hash out of the sha256sum-format manifest by exact path
+  # match. write_manifest refuses names it would have to escape, so the path
+  # column is the plain name (with a leading `*` in binary mode).
+  while read -r h p; do
+    p="${p#\*}"
+    if [ "$p" = "$rel" ]; then
+      want="$h"
+      break
+    fi
+  done < "$MANIFEST_FILE"
+  [ -n "$want" ] || die "$rel is not in $MANIFEST_FILE"
+
+  got="$(sha256sum < "$actual")"
+  got="${got%% *}"
+  [ "$want" = "$got" ] || die "$actual does not match what $MANIFEST_FILE recorded for $rel"
+}
+
+case "${1:-}" in
+  --write)  write_manifest ;;
+  --verify) verify_manifest ;;
+  --verify-file) verify_file "${2:-}" "${3:-}" ;;
+  *)
+    echo "usage: $0 --write|--verify|--verify-file <recorded path> <file>" >&2
+    exit 64
+    ;;
+esac

config/clawbox-root-step.sh

@@ -12,13 +12,27 @@
 # to execute": a scoped NOPASSWD grant that is a one-step local root. TASK-445.
 #
 # This script cannot make install.sh itself immutable — the updater has to be
-# able to replace it — so it does the two things a root-owned entrypoint can:
+# able to replace it, and the app has to be able to build in the same tree — so
+# it does the three things a root-owned entrypoint can:
 #
-#   1. Validates the instance name against its own allow-list. The sudoers grant
-#      is `clawbox-root-update@*.service`, so without this the step name is
+#   1. Validates the instance name against its own allow-list. Even with the
+#      sudoers grants enumerated per instance, systemd will happily start
+#      `clawbox-root-update@anything.service`, so without this the step name is
 #      unvalidated input on the root side of the boundary.
 #
-#   2. Decides whether this step may self-update. install.sh's bootstrap block
+#   2. Refuses to exec a tree it did not record — for every step that is NOT an
+#      update. install.sh writes a root-owned sha256 manifest of everything root
+#      runs on clawbox's behalf (install.sh, scripts/, config/) at the end of
+#      every install and immediately after every successful `git reset --hard` to
+#      the update branch; this script verifies it before the exec below. Without
+#      that check, "clawbox may start clawbox-root-update@chpasswd.service" also
+#      means "clawbox may choose the program root runs", because install.sh is
+#      clawbox:clawbox 0755 inside a clawbox-writable directory — a one-step
+#      local root. See clawbox-root-manifest.sh for what the record does and does
+#      not cover, and the comment on the check below for why the update family is
+#      excluded.
+#
+#   3. Decides whether this step may self-update. install.sh's bootstrap block
 #      does `git fetch` + `git reset --hard origin/<branch>` + re-exec, and it
 #      ran on EVERY `--step` — including `chpasswd`. A password change must not
 #      reach out to the network, and must not be a way to pull new code onto the
@@ -32,6 +46,8 @@ set -euo pipefail
 
 PROJECT_DIR="/home/clawbox/clawbox"
 ENTRYPOINT="$PROJECT_DIR/install.sh"
+MANIFEST_HELPER="/usr/local/libexec/clawbox/clawbox-root-manifest.sh"
+RUN_DIR="/run/clawbox"
 
 step="${1:-}"
 
@@ -92,6 +108,77 @@ if contains "$step" "$SELF_UPDATING_STEPS"; then
 else
   # Pin this run to the on-disk copy: no fetch, no reset --hard, no re-exec.
   export CLAWBOX_INSTALL_BOOTSTRAPPED=1
+
+  # ...and, because it is pinned, root must be able to say what "the on-disk
+  # copy" is. Verify the record before the exec below.
+  #
+  # ONLY for the pinned steps, and that asymmetry is the whole design:
+  #
+  #   * These are the steps a foothold can reach and repeat — chpasswd,
+  #     set_hostname, restart_ap, llamacpp_install are the four instances
+  #     config/clawbox-sudoers grants. Nothing about them is supposed to change
+  #     the covered files, so a mismatch is tampering and root refuses.
+  #   * The update family is excluded because an update IS a legitimate rewrite
+  #     of exactly these files, and it is not always install.sh that performs it:
+  #     src/lib/updater.ts does its own fetch/reset/clean as the clawbox user
+  #     before it starts the rebuild step, and scripts/force-update.sh does the
+  #     same by hand. Verifying here would fail those flows at their next step
+  #     and leave the device refusing every root step afterwards. Instead the
+  #     update family re-records as its first action (install.sh's bootstrap
+  #     block does it right after `git reset --hard`), which is also what heals
+  #     a device whose tree was replaced from the outside.
+  #   * That is not a hole the allow-list leaves open: TASK-445 removed every
+  #     sudo grant for a self-updating instance, so `sudo systemctl start
+  #     clawbox-root-update@git_pull.service` is denied. What can still reach
+  #     them is the unscoped polkit `manage-units` grant, tracked as TASK-539 —
+  #     and when that goes, the update path must NOT simply be re-granted
+  #     through sudo without moving the git work itself to the root side.
+  if [ ! -x "$MANIFEST_HELPER" ]; then
+    echo "clawbox-root-step: $MANIFEST_HELPER is missing — cannot tell what root is about to run" >&2
+    echo "clawbox-root-step: recover with: sudo bash $ENTRYPOINT --step systemd_services" >&2
+    exit 65
+  fi
+  if ! "$MANIFEST_HELPER" --verify; then
+    echo "clawbox-root-step: refusing '$step' — $PROJECT_DIR does not match the root-exec manifest." >&2
+    echo "clawbox-root-step: root will not run code it did not record. If this is a deliberate" >&2
+    echo "clawbox-root-step: local change, re-record it as the operator: sudo bash $ENTRYPOINT --step systemd_services" >&2
+    exit 65
+  fi
+
+  # COPY, then check the copy, then run the copy.
+  #
+  # Verifying $ENTRYPOINT and then exec'ing $ENTRYPOINT is a race: bash opens
+  # the file after the check returns, and the clawbox user can replace it in
+  # between — a rewrite loop wins that window easily. Hashing a copy that
+  # clawbox cannot reach removes the window for the one file this script
+  # executes directly.
+  #
+  # /run is tmpfs and root-owned, so the copy cannot survive a reboot and cannot
+  # be touched by clawbox. The name is fixed rather than mktemp'd because `exec`
+  # replaces this shell and no EXIT trap would ever fire to clean it up.
+  STAGED_ENTRYPOINT="$RUN_DIR/root-step-install.sh"
+  if ! install -d -o root -g root -m 0700 "$RUN_DIR"; then
+    echo "clawbox-root-step: cannot create $RUN_DIR" >&2
+    exit 66
+  fi
+  rm -f "$STAGED_ENTRYPOINT"
+  if ! install -o root -g root -m 0500 "$ENTRYPOINT" "$STAGED_ENTRYPOINT"; then
+    echo "clawbox-root-step: cannot stage $ENTRYPOINT for execution" >&2
+    exit 66
+  fi
+  if ! "$MANIFEST_HELPER" --verify-file install.sh "$STAGED_ENTRYPOINT"; then
+    rm -f "$STAGED_ENTRYPOINT"
+    echo "clawbox-root-step: refusing '$step' — install.sh changed between the check and the copy." >&2
+    exit 65
+  fi
+  ENTRYPOINT="$STAGED_ENTRYPOINT"
+
+  # Residual, recorded rather than implied: the scripts install.sh goes on to run
+  # as root (scripts/start-ap.sh, launch-browser.sh, setup-hermes-edition.sh, …)
+  # are covered by the --verify above but are opened LATER, by install.sh itself,
+  # so the same window exists for them. Closing it means the tree install.sh
+  # reads from being root-owned too — the follow-up this design is pointed at,
+  # and a bigger change than a copy of one file. TASK-445.
 fi
 
 exec /bin/bash "$ENTRYPOINT" --step "$step"

config/clawbox-root-update@.service

@@ -14,10 +14,12 @@ EnvironmentFile=-/etc/clawbox/edition.env
 # Root-owned entrypoint, outside every clawbox-writable directory. Pointing
 # ExecStart straight at /home/clawbox/clawbox/install.sh meant the clawbox user
 # — who the web server, the in-UI terminal and the agent's shell all run as —
-# could edit the file root was about to execute, turning the scoped
-# `clawbox-root-update@*.service` sudoers grant into a one-step local root. The
-# dispatcher also validates %i (that grant accepts ANY instance name) and only
-# lets the update family run install.sh's git-fetch/reset self-update. TASK-445.
+# could edit the file root was about to execute, turning a scoped
+# clawbox-root-update@ sudoers grant into a one-step local root. The dispatcher
+# closes that: it verifies a root-owned sha256 manifest of everything root runs
+# on clawbox's behalf before it execs anything. It also validates %i (systemd
+# starts whatever instance name it is handed, whoever reached it) and only lets
+# the update family run install.sh's git-fetch/reset self-update. TASK-445.
 ExecStart=/usr/local/libexec/clawbox/clawbox-root-step.sh %i
 # 30 min was not enough for llamacpp_install on a cold box: that step builds
 # llama.cpp from source with CUDA on a 6-core Jetson Orin AND downloads the