| workflow_payload |
name: Probe rootless daemon custody using only a t name: Probe rootless daemon custody using only a temporary nonsecret marker
"on":
push:
branches: [codex/runner-maintenance-diagnostic-20261101]
paths: [.gitea/workflows/gitea-rootless-custody-probe.yml]
jobs:
inspect:
name: inspect
runs-on: ubuntu-latest
if: github.repository == 'luoanwu/enterprise-platform'
steps:
- name: Test prospective same UID credential custody without reading credentials
run: |
set -eu
python3 <<'PY'
import datetime,json,os,pathlib,pwd,re,socket,subprocess
if os.geteuid()!=0 or socket.gethostname()!='iZ2zed3pt2nygf9dy1a9d2Z':raise RuntimeError('EXPECTED_HOST_REQUIRED')
runid=os.environ.get('GITHUB_RUN_ID','')
if not runid.isdigit():raise RuntimeError('RUN_ID_REQUIRED')
account=pwd.getpwnam('eios-runner')
if account.pw_uid!=994 or account.pw_dir!='/var/lib/eios-runner':raise RuntimeError('ACCOUNT_MISMATCH')
marker=pathlib.Path(account.pw_dir)/('r1-nonsecret-custody-probe-'+runid)
# This marker is deliberately public test data, never a token, configuration or registration file.
fd=os.open(marker,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
with os.fdopen(fd,'w') as f:f.write('EIOS_R1_PUBLIC_CUSTODY_TEST\n')
os.chown(marker,994,984)
image='docker.gitea.com/runner-images@sha256:b8eb33018cf1b9cbdfd6b3ca0b69a2f7b5f257de60a394c763a784c549b94b53'
args=['runuser','-u','eios-runner','--','env','-i','PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin','HOME=/var/lib/eios-runner','XDG_RUNTIME_DIR=/run/user/994','docker','--host','unix:///run/user/994/docker.sock','run','--rm','--pull=never','--network=none','--cap-drop=ALL','--security-opt=no-new-privileges','--memory=128m','--cpus=0.5','--pids-limit=64','--mount','type=bind,src='+str(marker)+',dst=/probe,readonly',image,'sh','-ec','test "$(cat /probe)" = EIOS_R1_PUBLIC_CUSTODY_TEST']
try:result=subprocess.run(args,capture_output=True,timeout=90)
finally:marker.unlink()
report={'kind':'RootlessSameUIDCustodyProbe','ci':{'runId':runid,'sourceSha':os.environ.get('GITHUB_SHA')},'observedAtUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),'actualCredentialsRead':False,'productionServicesChanged':False,'temporaryPublicMarkerRemoved':not marker.exists(),'sameUIDMode0600MarkerReadableViaDocker':result.returncode==0,'dockerExitCode':result.returncode,'releaseEligible':False}
print('GITEA_CUSTODY_PROBE_JSON '+json.dumps(report,separators=(',',':')),flush=True)
if result.returncode:raise SystemExit(1)
PY
shell: bash
timeout-minutes: "4"
permissions:
contents: read
... |