[vyskocilm]

Closes #641. Stacked on #642 (#637), which provides trustedParent. The base is fix/637-bind-by-fd; retarget to main after #642 merges.

Why

snug took its home from $HOME while every other account fact came from getent, so the two could disagree. HOME=/etc ran with exit 0 and let the payload write /etc/ld.so.preload, which the next dynamically linked program honoured (measured by sandbox-policy).

Rule (maintainer: refuse mismatch, unset HOME takes pw_dir, pinned getent, test fixture build, nested reads snug's own passwd)

• Account source.
  • Host: getent only at /usr/bin/getent or /bin/getent. It must be root-owned with no group/other write all the way down (policy.TrustedExecutable over authorableLinks + trustedParent) and is run with an empty environment. $PATH is never searched.
  • Inside a snug sandbox (single-line uid map) snug parses the generated /etc/passwd itself, on the descriptor it reads. It must be a regular file owned by the user, on a read-only tmpfs mount on the same device as the root tmpfs, and contain exactly one 7-field line with uid/gid matching.
  • A plain user namespace refuses ("not a snug sandbox"). A nested run whose outer selection has no nss refuses and names nss = true.
• Home is pw_dir.
  • A $HOME that resolves elsewhere refuses: $HOME "X" is not this account's home directory "Y" (getent passwd); snug takes the home from the account. Unset HOME, or set HOME=Y.
  • Unset HOME takes pw_dir.
  • A home that is a system tree (/ /bin /boot /dev /etc /lib /lib64 /proc /run /sbin /snug /sys /tmp /usr /var) refuses.
  • The lookup runs before profiles load. HostAccountErr is gone.
• claudeFiles uses pol.Home, and the dry-run basename fallbacks are gone.
• --dry-run notes gain snug: account: <name>, home <home> (from <source>).

Tests

• bin/snug-fixture (-tags snugfixture, SNUG_FIXTURE_ACCOUNT_HOME) replaces only the home for integration fixtures. TestShippedBinaryHasNoAccountFixture checks the untagged binary lacks it (the tagged build has it as a control), and only the fixture/gate Makefile recipes name the tag.
• Raw-userns harnesses (engine preflight P2, two DNS tests, outer pidns) build a snug-shaped authored passwd. Each still asserts its original subject plus (from snug's generated /etc/passwd).
• policy: AccountHome cases, the system-tree table (15 entries hard-coded), the TrustedExecutable table (18 cases, including 65534).
• getent: ChooseSource, AuthoredMountRule (measured snug mountinfo, plus a later bind over /etc), strict parser, owner/symlink/FIFO, never $PATH, empty environment.
• cli: lookup failure refuses before profiles load; HOME mismatch; claude mounts under pol.Home.
• integration: HOME mismatch 77; unset HOME follows the account; system-tree home 77; nested dry-run uses the outer home; nested unset HOME; nested changed HOME 77; nested without nss 77; plain userns 77; shadowed authored passwd 77 (--no-seccomp, payload binds over /etc; positive control: getent shows the forged home); nested real run under the default seccomp pinned to fork/exec /proc/self/exe: operation not permitted.
• TestQuietRunsAreQuiet: the NOTES block may contain exactly the account line.
• Mutations: ChooseSource always authored, TrustedExecutable accepting 65534, and the mount check made inert each fail named tests.
• Golden diff: none.

Verification

• make gate: pass.
• make verify: 5 pass, 3 skip.
• Full make integration before the rebase onto updated sandbox: bind every grant source by descriptor, opened without following symlinks (closes #637) #642: 319 pass, 3 skip, 2 fail. The 2 fails were the login-bridge tests sandbox: bind every grant source by descriptor, opened without following symlinks (closes #637) #642 since ported. A targeted run after the rebase (login bridge, account, nested, DNS, outer pidns, quiet run, preflight): ok.
• Direct checks on the built binary:
  • fake getent first on PATH: ignored, account (from /usr/bin/getent);
  • LD_PRELOAD=/nonexistent.so: ignored;
  • HOME=/etc: 77;
  • relative HOME: 77 naming the fix;
  • HOME=/home/michal/: accepted (same directory);
  • env -i: home /home/michal.
• No redteam agent round: the classifier cut every recent round, so the checks above were run directly.

Residuals

• XDG_CONFIG_HOME still picks the trusted profile directory, and XDG_DATA_HOME the engine store (environment authority).
• config, profile show and doctor still read $HOME unchecked.
• NixOS and plain user namespaces refuse.
• A real nested run needs the outer run to use --no-seccomp, and under it a payload with its own tmpfs root can choose an inner home. That grants nothing beyond the outer view.

🤖 Generated with Claude Code