Bug 2069268 - move the guest health probe onto the key-only probe account - #75
Merged
Merged
Conversation
Context: bug 2069268 (restricted). _guest() previously authenticated to the guest with a shared credential, driven through expect. It now uses the `probe` account added in ronin_puppet#1366: key auth only, unprivileged, with a small fixed set of permitted sudo commands. The worker-id read is matched to the pinned sudoers entry exactly. The previous form used a pattern containing glob metacharacters; sudoers matches command arguments with fnmatch(3), so that entry could never have matched the invocation and the call would have been denied -- with the field coming back empty and nothing to explain why. Extraction moved to the unprivileged side and made tolerant of the config shapes worker-runner emits at runtime. Dropping expect also removes the two workarounds it needed, which together made this silently useless for months (26/26 slots reporting guest_reachable:false): the Tcl quoting hop, and a prompt match that never fired. The base64 hop is kept -- it is still the cheapest way to stop the remote shell reinterpreting the probe. TART_GUEST_PROBE_USER / TART_GUEST_PROBE_KEY override the user and key path for testing during the transition. Adds a regression test asserting key auth is used and the previous mechanism cannot silently return. 27 tests pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
rcurranmoz
force-pushed
the
bug-2069268-guest-probe-key
branch
from
September 9, 2026 12:19
5fbff02 to
ac1fa2d
Compare
rcurranmoz
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the guest health probe from a shared-credential login onto the dedicated key-only
probeaccount added in ronin_puppet#1366.Context in bug 2069268 (restricted).
What changed
_guest()authenticates with the probe key instead of a password, and runs as an unprivileged account whose sudo is limited to two pinned commands.fnmatch(3), so that rule could never have matched and the call would have been denied with the field silently coming back empty.expectwrapper, and with it the two workarounds it needed — the Tcl quoting hop and a prompt match that never fired. That combination made this silently useless for months (26/26 slots reportingguest_reachable:false).TART_GUEST_PROBE_USER/TART_GUEST_PROBE_KEYoverride the user and key path for testing during the transition.Testing
27 tests pass, including a new regression test asserting the probe uses key authentication and that the previous mechanism cannot silently return.