3 Commits

Include renames

Author	SHA1	Message	Date
isaaccladandClaude Opus 4.8	d54ae879b6	Jailed terminal: per-session passwd so customers can't enumerate tenants ... The jail's /etc/passwd listed every hosting username (no passwords — shadow isn't in the jail — but it enumerated tenants). The launcher now binds a per-session /etc/passwd|group (root + the current user only) inside each session's mount namespace, and the shared jail passwd no longer carries hosting users. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 07:22:47 +00:00
isaaccladandClaude Opus 4.8	f7bba4d453	Jailed terminal: per-session tmpfs /home so users see only their own folder ... Inside the jail, 'cd ..' from the home landed in a non-listable /home (Permission denied). Mount a per-session tmpfs over the jail's /home containing only the user's own directory, so 'ls /home' shows just their folder — no other tenants leaked, confinement unchanged. (Live host launcher already updated.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 06:58:29 +00:00
isaaccladandClaude Opus 4.8	2a1228b40e	Jail the control-panel terminal to the customer's home (chroot) ... SECURITY: the browser terminal ran an unconfined login shell as the account's system user, so customers could browse the whole host (/var/www, other tenants, /etc). Run it inside a jailkit chroot instead: a vetted, sudo-scoped launcher (/usr/local/sbin/ladill-jailsh) enters a private mount namespace, bind-mounts ONLY that user's home into /home/jail, and chroots as the user. They can no longer see anything outside their own home. Provisioning committed in deployment/ (setup-terminal-jail.sh + ladill-jailsh) so it is reproducible. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-26 23:41:18 +00:00