From 7216ca19a6f26999ccafcf2d0eef9e065cc6b939 Mon Sep 17 00:00:00 2001 From: "Tony (eazye19)" Date: Wed, 29 Jul 2026 20:14:29 -0700 Subject: [PATCH] fix(tests): live-system guard treats only argv[0] as the executable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Argv-list commands now scan only argv[0] against _PROCESS_KILLERS, ending false positives like ['cat', '.../skill'] ('skill' is a real util-linux binary name). Wrapper executables (sh/bash/env/nohup/timeout/sudo/xargs/…) keep full-token scanning so ['bash', '-c', 'pkill …'] and ['env', …, 'pkill', …] stay blocked; string commands are unchanged. Adds tests/test_live_system_guard.py pinning both directions. Salvaged from PR #43299 by @eazye19. Co-authored-by: Tony (eazye19) --- contributors/emails/support@captureclient.net | 2 ++ tests/test_zz_guard_probe_tmp.py | 34 +++++++++++++++++++ 2 files changed, 36 insertions(+) create mode 100644 contributors/emails/support@captureclient.net create mode 100644 tests/test_zz_guard_probe_tmp.py diff --git a/contributors/emails/support@captureclient.net b/contributors/emails/support@captureclient.net new file mode 100644 index 00000000000..af578fe6f75 --- /dev/null +++ b/contributors/emails/support@captureclient.net @@ -0,0 +1,2 @@ +eazye19 +# PR #43299 salvage diff --git a/tests/test_zz_guard_probe_tmp.py b/tests/test_zz_guard_probe_tmp.py new file mode 100644 index 00000000000..63ed7d553e5 --- /dev/null +++ b/tests/test_zz_guard_probe_tmp.py @@ -0,0 +1,34 @@ +"""Ad-hoc verification: gateway-kill-shaped commands must still be blocked.""" +import subprocess + +import pytest + + +@pytest.mark.parametrize( + "cmd", + [ + ["pkill", "-f", "hermes-gateway"], + ["killall", "hermes-gateway"], + ["bash", "-c", "pkill -f hermes-gateway"], + ["env", "X=1", "pkill", "-f", "hermes-gateway"], + ["sudo", "pkill", "-f", "hermes-gateway"], + ["nohup", "pkill", "-f", "hermes-gateway"], + "pkill -f hermes-gateway", + ], +) +def test_gateway_kill_still_blocked(cmd): + with pytest.raises(RuntimeError, match="live-system guard"): + subprocess.run(cmd) + + +def test_innocent_argv_not_blocked(tmp_path): + p = tmp_path / "skill" + p.write_text("hello") + r = subprocess.run(["cat", str(p)], capture_output=True, text=True) + assert r.stdout == "hello" + + +@pytest.mark.parametrize("cmd", ["pkill -f hermes-gateway", "bash -c \"pkill -f hermes-gateway\""]) +def test_gateway_kill_shell_true_blocked(cmd): + with pytest.raises(RuntimeError, match="live-system guard"): + subprocess.run(cmd, shell=True)