feat(chv): 安全审计修复 High/Medium/Low（堆叠于 #239）
审计报告 ~/workspace/chv-security-audit/REPORT.md（No-Go， Critical 0 / High 7 / Medium 8 / Low 5）代码层修复，mock 测试覆盖，真机动态验证一律未做、只列清单（见 docs/chv-production-readiness.md §11）。 High： - H1 egress 代码门：代理地址校验、直连显式允许+审计、 每 VM 独立 tap/mac/ip 校验、net 字段白名单；宿主防火墙 列为部署清单，代码门+防火墙缺一不可。 - H2 网关 key 移出 argv：provisioned seed 盘客内文件 /etc/chv/guest-env（0600）投递，传输层密钥进 argv 直接 ValueError；keyscan 模式密钥投递 fail-closed。 - H3 任务盘删除：stop/recycle/cleanup 删 disk.raw（保留期 0）+ 残留盘 GC，删失败审计+脏标记。 - H4 默认值改 provisioned：keyscan 只作显式 opt-in。 - H5 seed.iso 生成即 0600；宿主私钥 seed 盘建好后即删； 崩溃残留扫描 cleanup_stale_secrets。 - H6 state_dir 默认出 /tmp（~/.local/share/.../chv-vms， preflight 保 0700）；api-socket 组/其它可写即 fail-fast。 - H7 tap 隔离校验：net.json 登记+stop 释放，共享即拒绝审计。 Medium：M1 shlex 远程转义；M2 清理失败即拒起（脏标记）； M3 配额默认 50GB + 快照数/总量/保留期上限；M4 SHA256 必填 + BUILDINFO versions 实测记录（事前 lockfile 列清单）； M5 host key/ preflight/失败审计补齐；M6 reuse 须声明单租户 项目；M7 容量计数只认连通 socket；M8 sshd 加固进 build.sh 断言。Low：L1 链接不跟随；L2 路径白名单；L3 失败审计； L4 双变量警告+字段白名单；L5 预热盘/任务盘对应关系定义。 旧测试：实验室默认值与生产默认值区分标注；行为已变的旧 测试按新语义更新（容量死 socket、快照白名单、磁盘路径 白名单、网关 argv、reuse 租户声明）。 测试：新 test_chv_secfix 39 项；旧 117 项 + 2 项新增断言 = 158 项；worker 相关 129 项；前端 vitest 9 项；cloud 全量 1588 项（skipped 4）。
This commit is contained in:
host committed
1 parent
003ea357f9
commit
baf26beb78
16 files changed
+2106
-132
No files matched your search
+47
-7
@@ -10,9 +10,15 @@
|
||||
# vmlinux # virt-get-kernel 从云镜像取出的内核（CHV --kernel 指向它）
|
||||
# disk.raw # qemu-img 转成的 raw 根文件系统镜像（CHV_ROOTFS 指向它）
|
||||
# BUILDINFO.json # {tag, ubuntu, codex_version, repo_commit, built_at, contents}
|
||||
# + versions {dpkg, pip}（构建时从客机读回的实际版本）+
|
||||
# ubuntu_image_sha256_set（SHA256 必填，见下）
|
||||
# 绝不进镜像的东西：任何模型 key、系统 key、用户账号数据、
|
||||
# 生产凭证；模型 key 由客机 cloud-init 预置的运行环境变量名
|
||||
# 注入，不写进镜像层。
|
||||
# feat-chv-secfix（M4/M8）：UBUNTU_IMAGE_SHA256 必填；
|
||||
# sshd 加固由构建写入 /etc/ssh/sshd_config.d/99-chv.conf
|
||||
# 并经 sshd -t + grep 断言（README 的“只允许 key 登录”
|
||||
# 从此是构建断言，不再只是文档声称）。
|
||||
#
|
||||
# 客机 host key 硬性要求（见 README §5，补缺口轨新增）：
|
||||
# 客机必须装 cloud-init 且支持 NoCloud seed，首启先应用
|
||||
@@ -66,7 +72,7 @@ if [ "$DRY_RUN" = "0" ]; then
|
||||
echo "CHV_GUEST_BUILD needs a KVM host: /dev/kvm 不存在" >&2
|
||||
exit 1
|
||||
fi
|
||||
for tool in curl qemu-img virt-customize virt-get-kernel python3; do
|
||||
for tool in curl qemu-img virt-customize virt-get-kernel python3 virt-cat; do
|
||||
if ! command -v "$tool" >/dev/null 2>&1; then
|
||||
echo "缺少构建工具：$tool，构建失败" >&2
|
||||
exit 1
|
||||
@@ -76,17 +82,23 @@ fi
|
||||
|
||||
run mkdir -p "$OUT"
|
||||
IMG="$OUT/ubuntu-${UBUNTU_VERSION}-server-cloudimg-amd64.img"
|
||||
# feat-chv-secfix（M4）：云镜像 SHA256 改为必填（干跑只验
|
||||
# “已设”，不验文件；全量模式下载后验哈希）。未设即失败，
|
||||
# 不再只依赖 HTTPS 传输层作唯一锚。
|
||||
if [ -z "${UBUNTU_IMAGE_SHA256:-}" ]; then
|
||||
echo "UBUNTU_IMAGE_SHA256 未设：云镜像须以哈希锚定，构建失败" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [ "$DRY_RUN" = "1" ]; then
|
||||
echo "DRY-RUN: curl -fL $UBUNTU_IMAGE_URL -o $IMG"
|
||||
echo "DRY-RUN: [ -s $IMG ] || exit 1"
|
||||
echo "DRY-RUN: sha256sum -c (UBUNTU_IMAGE_SHA256)"
|
||||
else
|
||||
if [ ! -s "$IMG" ]; then
|
||||
curl -fL "$UBUNTU_IMAGE_URL" -o "$IMG"
|
||||
fi
|
||||
[ -s "$IMG" ] || { echo "下载的云镜像为空：$IMG" >&2; exit 1; }
|
||||
if [ -n "${UBUNTU_IMAGE_SHA256:-}" ]; then
|
||||
echo "$UBUNTU_IMAGE_SHA256 $IMG" | sha256sum -c -
|
||||
fi
|
||||
echo "$UBUNTU_IMAGE_SHA256 $IMG" | sha256sum -c -
|
||||
fi
|
||||
run qemu-img convert -f qcow2 -O raw "$IMG" "$OUT/disk.raw"
|
||||
# 清单软件（照抄 cloud/docker/Dockerfile 的 apt/pip 清单，
|
||||
@@ -102,12 +114,27 @@ run virt-customize -a "$OUT/disk.raw" \
|
||||
--mkdir /app \
|
||||
--copy-in "$REPO_DIR/host.py:/app/" \
|
||||
--copy-in "$REPO_DIR/cloud:/app/" \
|
||||
--run-command 'printf "ssh_deletekeys: false\nssh_genkeytypes: []\n" > /etc/cloud/cloud.cfg.d/99-chv-hostkey.cfg; systemctl enable ssh || true'
|
||||
--run-command 'printf "ssh_deletekeys: false\nssh_genkeytypes: []\n" > /etc/cloud/cloud.cfg.d/99-chv-hostkey.cfg; systemctl enable ssh || true' \
|
||||
--run-command 'printf "PasswordAuthentication no\nPermitRootLogin prohibit-password\nChallengeResponseAuthentication no\nKbdInteractiveAuthentication no\nPubkeyAuthentication yes\n" > /etc/ssh/sshd_config.d/99-chv.conf; sshd -t && grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config.d/99-chv.conf && grep -q "^PermitRootLogin prohibit-password" /etc/ssh/sshd_config.d/99-chv.conf' \
|
||||
--run-command 'dpkg-query -W -f "${Package} ${Version}\n" > /app/guest-versions-dpkg.txt; pip3 freeze > /app/guest-versions-pip.txt || true'
|
||||
if [ "${PLAYWRIGHT:-0}" = "1" ]; then
|
||||
run virt-customize -a "$OUT/disk.raw" \
|
||||
--run-command 'pip3 install --no-cache-dir playwright; python3 -m playwright install --with-deps chromium'
|
||||
fi
|
||||
run virt-get-kernel -a "$OUT/disk.raw" -o "$OUT/vmlinux"
|
||||
# feat-chv-secfix（M4）：构建时把客机内实际装好的版本
|
||||
# 读回 BUILDINFO.versions（dpkg + pip freeze），名字列表
|
||||
# 之外再有逐项版本——可审计、可复现比对。事前 lockfile
|
||||
# 钉死（apt/pip 精确版本预先锁定）仍待构建宿主生成，
|
||||
# 见 README 与就绪清单 §11；本步先保证“建成什么版本
|
||||
# 都有记录”，不再只有名字。
|
||||
if [ "$DRY_RUN" = "1" ]; then
|
||||
echo "DRY-RUN: virt-cat -a $OUT/disk.raw /app/guest-versions-dpkg.txt > $OUT/guest-versions-dpkg.txt"
|
||||
echo "DRY-RUN: virt-cat -a $OUT/disk.raw /app/guest-versions-pip.txt > $OUT/guest-versions-pip.txt"
|
||||
else
|
||||
virt-cat -a "$OUT/disk.raw" /app/guest-versions-dpkg.txt > "$OUT/guest-versions-dpkg.txt"
|
||||
virt-cat -a "$OUT/disk.raw" /app/guest-versions-pip.txt > "$OUT/guest-versions-pip.txt"
|
||||
fi
|
||||
# 产物校验（干跑只打印，不执行校验命令的副作用部分）。
|
||||
if [ "$DRY_RUN" = "1" ]; then
|
||||
echo "DRY-RUN: test -s $OUT/vmlinux && test -s $OUT/disk.raw"
|
||||
@@ -118,16 +145,29 @@ else
|
||||
python3 - "$OUT/BUILDINFO.json" "$TAG" "$UBUNTU_VERSION" "$CODEX_VERSION" "$REPO_COMMIT" <<'PYEOF'
|
||||
import json, sys, time
|
||||
path, tag, ubuntu, codex, commit = sys.argv[1:6]
|
||||
def _read_lines(p):
|
||||
try:
|
||||
with open(p) as fh:
|
||||
return [l.strip() for l in fh if l.strip()]
|
||||
except OSError:
|
||||
return []
|
||||
import os
|
||||
outdir = os.path.dirname(path)
|
||||
info = {"tag": tag, "ubuntu": ubuntu, "codex_version": codex,
|
||||
"repo_commit": commit, "built_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
|
||||
"contents": ["git", "pandoc", "poppler-utils", "latexmk", "texlive-latex-base",
|
||||
"openssh-server", "cloud-init", "qemu-guest-agent",
|
||||
"python-docx", "openpyxl", "python-pptx", "PyMuPDF", "Pillow",
|
||||
"codex", "codex-code-mode-host", "codex-resources/bwrap", "/app/host.py"]}
|
||||
"codex", "codex-code-mode-host", "codex-resources/bwrap", "/app/host.py"],
|
||||
"versions": {
|
||||
"dpkg": _read_lines(os.path.join(outdir, "guest-versions-dpkg.txt")),
|
||||
"pip": _read_lines(os.path.join(outdir, "guest-versions-pip.txt")),
|
||||
},
|
||||
"ubuntu_image_sha256_set": True}
|
||||
with open(path, "w") as fh:
|
||||
json.dump(info, fh, indent=2)
|
||||
PYEOF
|
||||
python3 -c "import json; d=json.load(open('$OUT/BUILDINFO.json')); assert d['tag'] == '$TAG', d"
|
||||
python3 -c "import json; d=json.load(open('$OUT/BUILDINFO.json')); assert d['tag'] == '$TAG', d; assert d['versions']['dpkg'], 'BUILDINFO versions.dpkg 为空'; assert d['versions']['pip'], 'BUILDINFO versions.pip 为空'"
|
||||
fi
|
||||
echo "tag=$TAG"
|
||||
echo "out=$OUT"
|
||||
|
||||
Reference in new issue
Block a user