mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-05-29 06:31:32 +00:00
2f8ceeab9a
PR #30136 review surfaced two issues, both rooted in the same audit gap: docker integration tests were running as root, not the unprivileged `hermes` user (UID 10000) that the runtime actually uses via `s6-setuidgid hermes`. Anything that probed PID-1 state or wrote to the s6 control surface worked as root in the tests but was inert in production. Fixes: 1. `_s6_running()` previously called `Path("/proc/1/exe").resolve()`, which is root-only readable. For UID 10000 the symlink yields PermissionError, `resolve()` silently returns the unresolved path, and `exe.name == "exe"` — so detection always returned False, the service-manager runtime-registration path was inert, and every `hermes profile create` / `hermes -p X gateway start` silently skipped the s6 hook. Replace with `/proc/1/comm` (world-readable) + `/run/s6/basedir` (s6-overlay-specific) — both required, fail closed. 2. `02-reconcile-profiles` now also chowns `/run/service/.s6-svscan/` {control,lock} to hermes so `s6-svscanctl -a/-an` works without root. Previously the directory chown stopped at `/run/service` and the FIFO inside stayed root-owned, so `register_profile_gateway` from hermes failed at the rescan-trigger step with EACCES — the wrapper in profiles.py caught the exception and printed a swallowed warning, so profile creation appeared to succeed while the slot was rolled back. Audit changes to flush this class of bug next time: - Add `docker_exec` / `docker_exec_sh` helpers to `tests/docker/conftest.py` that default to `-u hermes`. The module docstring explains why and flags `user="root"` as opt-in only for tests that explicitly need root (none currently do). - Refactor every `docker exec` call in tests/docker/ through the new helpers (test_dashboard.py, test_zombie_reaping.py, test_profile_gateway.py, test_container_restart.py, test_s6_profile_gateway_integration.py). - Add 5 unit tests covering `_s6_running` under various probe states (both signals present; comm wrong; basedir missing; PermissionError on /proc/1/comm; missing /proc — non-Linux). The PermissionError test is the explicit regression guard for the original bug. Known follow-up: the per-service `supervise/control` FIFO inside each `/run/service/gateway-<profile>/supervise/` is created root-owned by s6-supervise (which runs as root because s6-svscan is PID 1). `s6-svc -u/-d/-t` from the hermes user will get EACCES on those. The audit under `-u hermes` will reveal this in lifecycle tests — surfacing the issue cleanly so it can be fixed in a focused follow-up (likely via a small SUID helper or a polling chown loop in cont-init.d). The detection + svscanctl fixes here are independent and complete on their own.
45 lines
1.6 KiB
Python
45 lines
1.6 KiB
Python
"""Harness: PID 1 must reap orphaned zombie processes.
|
|
|
|
tini (current PID 1) reaps zombies via its built-in subreaper behavior.
|
|
s6-overlay's ``/init`` (Phase 2 PID 1) does the same. This invariant is
|
|
required for long-running containers spawning subprocesses (subagents,
|
|
dashboard, dynamic gateways) — otherwise the process table fills with
|
|
defunct entries and eventually exhausts the kernel PID space.
|
|
|
|
Every ``docker exec`` here runs as the unprivileged ``hermes`` user
|
|
(via :func:`docker_exec_sh` in conftest); see the conftest module
|
|
docstring.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import subprocess
|
|
import time
|
|
|
|
from tests.docker.conftest import docker_exec, docker_exec_sh
|
|
|
|
|
|
def test_orphan_zombies_reaped(
|
|
built_image: str, container_name: str,
|
|
) -> None:
|
|
"""Spawn an orphan child that exits immediately. PID 1 must reap it."""
|
|
subprocess.run(
|
|
["docker", "run", "-d", "--name", container_name, built_image,
|
|
"sleep", "60"],
|
|
check=True, capture_output=True, timeout=30,
|
|
)
|
|
time.sleep(2)
|
|
|
|
# `( ( sleep 0.1 & ) & ); sleep 1` creates a grandchild detached from
|
|
# the original docker exec session — it becomes an orphan reparented
|
|
# to PID 1 in the container. When it exits, PID 1 must reap it.
|
|
docker_exec_sh(
|
|
container_name, "( ( sleep 0.1 & ) & ); sleep 1", timeout=10,
|
|
)
|
|
time.sleep(1)
|
|
|
|
r = docker_exec(container_name, "ps", "axo", "stat,pid,comm")
|
|
zombies = [
|
|
line for line in r.stdout.split("\n")
|
|
if line.strip().startswith("Z")
|
|
]
|
|
assert not zombies, f"Zombies not reaped by PID 1: {zombies}"
|