thaloco/banger
1
Fork 0
Code Pull requests Releases Packages Activity Actions
banger/internal/daemon
History
Thales Maciel 3e6d0cee89
doctor: surface security-posture drift in banger doctor 
`docs/privileges.md` now documents what the install promises (helper +
daemon services active, sockets at 0600 ownerUID, units carrying the
hardening directives, firecracker root-owned + non-writable). Doctor
verifies the running install matches: drift between the doc and the
filesystem would silently weaken the trust model otherwise.

In system mode (install.toml present):
  * helper service / owner daemon service: `systemctl is-active`.
  * helper socket / daemon socket: stat-and-compare mode + uid against
    the registered owner.
  * helper unit hardening / daemon unit hardening: scan the rendered
    unit for NoNewPrivileges, ProtectSystem=strict, ProtectHome
    (=yes for the helper, =read-only for the daemon), RestrictSUIDSGID,
    LockPersonality, and the helper's CapabilityBoundingSet line. The
    daemon unit also pins User=<registered owner>.
  * firecracker binary ownership: regular file, not a symlink, mode
    not group/world writable, executable, owned by uid 0 — same
    constraints validateRootExecutable enforces at launch, surfaced
    once at doctor time so a misconfigured binary fails fast with a
    clearer error than the helper's open-time rejection.

In non-system mode (no /etc/banger/install.toml) doctor emits a single
WARN row pointing at docs/privileges.md > 'Running outside the system
install'. A PASS would imply guarantees the install isn't actually
providing.

Tests cover both branches: the non-system warn pins its message
substrings; system-mode pins that every check name shows up; and the
helpers (socket-perms, unit-hardening, executable-ownership) have
direct table-style negative tests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-28 14:58:34 -03:00
..
dmsnap Extract opstate and dmsnap into subpackages 2026-04-15 16:02:43 -03:00
fcproc roothelper: tighten input validation across privileged RPCs 2026-04-28 14:39:41 -03:00
imagemgr images: remove the docker field 2026-04-26 20:28:40 -03:00
opstate coverage: medium batch — hostnat runner, store guest-sessions, daemon helpers 2026-04-18 18:03:37 -03:00
workspace seams: move the last four package globals onto instance fields 2026-04-22 12:07:14 -03:00
ARCHITECTURE.md daemon: split owner daemon from root helper 2026-04-26 12:43:17 -03:00
autopull_test.go daemon: build a work-seed during image pull, refresh doctor check 2026-04-23 20:24:10 -03:00
capabilities.go daemon: surface previously-swallowed errors at warn 2026-04-26 22:30:51 -03:00
capabilities_test.go daemon: doctor passes vm dns when banger itself owns the port 2026-04-26 18:57:27 -03:00
concurrency_test.go daemon: build a work-seed during image pull, refresh doctor check 2026-04-23 20:24:10 -03:00
daemon.go roothelper: tighten input validation across privileged RPCs 2026-04-28 14:39:41 -03:00
daemon_test.go roothelper: tighten input validation across privileged RPCs 2026-04-28 14:39:41 -03:00
daemon_testing_test.go test: add newTestDaemon harness + options 2026-04-22 17:45:43 -03:00
dispatch.go daemon: extract StatsService sibling; shrink VMService's surface 2026-04-23 15:46:59 -03:00
dispatch_test.go daemon: thread per-RPC op_id end-to-end 2026-04-26 22:13:44 -03:00
dns_routing.go daemon: split owner daemon from root helper 2026-04-26 12:43:17 -03:00
dns_routing_test.go seams: move the last four package globals onto instance fields 2026-04-22 12:07:14 -03:00
doc.go daemon: split owner daemon from root helper 2026-04-26 12:43:17 -03:00
doctor.go doctor: surface security-posture drift in banger doctor 2026-04-28 14:58:34 -03:00
doctor_test.go doctor: surface security-posture drift in banger doctor 2026-04-28 14:58:34 -03:00
fake_firecracker_test.go remove vm session feature 2026-04-20 12:47:58 -03:00
fastpath_test.go daemon: build the work disk fresh instead of cloning the seed file 2026-04-26 20:42:10 -03:00
guest_ssh.go remove vm session feature 2026-04-20 12:47:58 -03:00
host_network.go daemon: split owner daemon from root helper 2026-04-26 12:43:17 -03:00
image_seed.go daemon: serialise concurrent image/kernel pulls + atomic-rename seed refresh 2026-04-27 17:24:11 -03:00
image_service.go daemon: tighten concurrency around pulls, cleanup, and handle persistence 2026-04-27 19:32:43 -03:00
images.go daemon: tighten concurrency around pulls, cleanup, and handle persistence 2026-04-27 19:32:43 -03:00
images_helpers_test.go coverage: medium batch — hostnat runner, store guest-sessions, daemon helpers 2026-04-18 18:03:37 -03:00
images_pull.go daemon: build a work-seed during image pull, refresh doctor check 2026-04-23 20:24:10 -03:00
images_pull_bundle_test.go daemon: build a work-seed during image pull, refresh doctor check 2026-04-23 20:24:10 -03:00
images_pull_test.go daemon: build a work-seed during image pull, refresh doctor check 2026-04-23 20:24:10 -03:00
kernels.go daemon: tighten concurrency around pulls, cleanup, and handle persistence 2026-04-27 19:32:43 -03:00
kernels_test.go daemon split (6/n): extract wireServices + drop lazy service getters 2026-04-21 15:55:28 -03:00
lifecycle_flow_test.go test: end-to-end VMService lifecycle flow harness 2026-04-22 17:55:04 -03:00
logger.go daemon: thread per-RPC op_id end-to-end 2026-04-26 22:13:44 -03:00
logger_test.go seams: move the last four package globals onto instance fields 2026-04-22 12:07:14 -03:00
nat.go daemon: split owner daemon from root helper 2026-04-26 12:43:17 -03:00
nat_capability_test.go daemon: persist tap device on VM.Runtime so NAT teardown survives handle-cache loss 2026-04-23 14:21:13 -03:00
nat_test.go vm state: split transient kernel/process handles off the durable schema 2026-04-19 14:18:13 -03:00
open_close_test.go daemon: split owner daemon from root helper 2026-04-26 12:43:17 -03:00
preflight.go daemon: split owner daemon from root helper 2026-04-26 12:43:17 -03:00
privileged_ops.go firecracker: adopt firecracker-jailer for VM launch (Phase B) 2026-04-28 14:38:07 -03:00
runtime_assets.go daemon split (4/5): extract *VMService service 2026-04-20 20:57:05 -03:00
snapshot.go daemon: split owner daemon from root helper 2026-04-26 12:43:17 -03:00
snapshot_test.go daemon split (6/n): extract wireServices + drop lazy service getters 2026-04-21 15:55:28 -03:00
ssh_client_config.go daemon: split owner daemon from root helper 2026-04-26 12:43:17 -03:00
ssh_client_config_test.go daemon: split owner daemon from root helper 2026-04-26 12:43:17 -03:00
sshd_config_test.go daemon: delete flattenNestedWorkHome and normaliseHomeDirPerms 2026-04-23 18:33:06 -03:00
stats_service.go daemon: thread per-RPC op_id end-to-end 2026-04-26 22:13:44 -03:00
stats_service_test.go daemon: extract StatsService sibling; shrink VMService's surface 2026-04-23 15:46:59 -03:00
tap_pool.go daemon: split owner daemon from root helper 2026-04-26 12:43:17 -03:00
vm.go firecracker: adopt firecracker-jailer for VM launch (Phase B) 2026-04-28 14:38:07 -03:00
vm_authsync.go daemon: split owner daemon from root helper 2026-04-26 12:43:17 -03:00
vm_create.go daemon: tighten concurrency around pulls, cleanup, and handle persistence 2026-04-27 19:32:43 -03:00
vm_create_ops.go daemon: thread per-RPC op_id end-to-end 2026-04-26 22:13:44 -03:00
vm_create_test.go model: validate VM names as DNS labels at CLI + daemon 2026-04-23 14:06:40 -03:00
vm_disk.go system: mkfs work disks with lazy_itable_init + lazy_journal_init 2026-04-26 21:32:57 -03:00
vm_handles.go daemon: tighten concurrency around pulls, cleanup, and handle persistence 2026-04-27 19:32:43 -03:00
vm_handles_test.go daemon: persist teardown fallbacks and reject unsafe import paths 2026-04-23 16:21:59 -03:00
vm_lifecycle.go daemon: sync guest over ssh before stop to preserve workspace writes 2026-04-27 15:41:32 -03:00
vm_lifecycle_steps.go firecracker: adopt firecracker-jailer for VM launch (Phase B) 2026-04-28 14:38:07 -03:00
vm_lifecycle_steps_test.go daemon: extract startVMLocked into step runner with per-step rollback 2026-04-23 15:34:34 -03:00
vm_locks.go Move subsystem state/locks off Daemon into owning types 2026-04-15 15:58:33 -03:00
vm_service.go daemon: thread per-RPC op_id end-to-end 2026-04-26 22:13:44 -03:00
vm_set.go daemon: thread per-RPC op_id end-to-end 2026-04-26 22:13:44 -03:00
vm_test.go roothelper: tighten input validation across privileged RPCs 2026-04-28 14:39:41 -03:00
workspace.go feat(vm): add vm exec command with workspace dirty detection 2026-04-26 23:53:45 -03:00
workspace_rejection_test.go tests: targeted coverage for doctor, workspace rejections, and nat capability 2026-04-22 12:58:12 -03:00
workspace_service.go daemon: thread per-RPC op_id end-to-end 2026-04-26 22:13:44 -03:00
workspace_test.go feat(vm): add vm exec command with workspace dirty detection 2026-04-26 23:53:45 -03:00