Repository navigation
Apply Security accessor prefixes at startup - #190
Closed
dmerron-r7 wants to merge 1 commit into
Closed
dmerron-r7 wants to merge 1 commit into
dmerron-r7 wants to merge 1 commit into
Conversation
scudette
pushed a commit
that referenced
this pull request
Oct 28, 2026
## Problem cloudvelo pins velociraptor `v0.74-105` (`c3e4d0b`). Moving to `v0.75.6` breaks the build, and once it compiles, server-side collections, flow reads and result sets regress (v0.75.5's client-id check, flow cache misses, result set `Abort()` corruption). ## Fix Pins `v0.75.6` (`0e657d6`, `go 1.25`), adapts to the changed APIs and fixes those regressions (itemised in the commit message). `build.yml` builds the GUI on Node 22.19 as velociraptor's own CI does (vite `^7.1.11` fails on Node 16); `test.yml` pins OpenSearch 2.19.6 and serialises packages with `-p 1`. Four follow-ups are stacked on this branch: #188, #189, #190, #191. ## Testing go1.25.3: `go build ./...` and `go test -run '^$' ./...` exit 0, and this PR's Tests workflow (OpenSearch-backed suites) passes on this branch alone. This branch plus the four follow-ups is the tree on which the Tests workflow passed (dmerron-r7#29) and on which Rapid7's embedding server passed 122 integration tests (0 errors, 0 failures, 4 skipped). `build.yml` runs only on push to master, so its Node change is unverified in CI; the vite build passes locally on Node 24.2. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
It's probably not super important for cloudvelo since there is nothing interesting in the filestore anyway other than those things that are already allowed. |
Upstream velociraptor builds the file and fs accessor prefix trees and the shadowed env vars in the sanity service, which cloudvelo does not run, so the Security.*_accessor_prefix and shadowed_env_vars settings were ignored and every fs read was allowed. security.Apply builds them before the fs accessor is registered. It follows upstream's fixed code (1fc79bbe6, v0.77.1), not 0.75.6's, which builds the fs allow tree from the file list, and keeps upstream's default fs deny list. It lives in startup/security, depending only on velociraptor packages, so an embedding binary can call it without linking cloudvelo/services/orgs. The Docker config limits fs to /clients, /downloads and /notebooks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dmerron-r7
force-pushed
the
upstream/velo-0.75-security-accessor-prefixes
branch
from
October 29, 2026 10:28
e51e56a to
bfd8843
Compare
dmerron-r7
marked this pull request as ready for review
October 29, 2026 10:39
Contributor
Author
|
Closing, as we carry this in our downstream build and as stated above it isn't useful/relevant for cloudvelo. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Upstream velociraptor builds the file/fs accessor prefix trees and shadowed env vars in the sanity service, which cloudvelo doesn't run, so
Security.*_accessor_prefixandshadowed_env_varsare ignored and everyfsread is allowed.Fix
startup/security'sApplybuilds them before thefsaccessor is registered, following upstream's fixed code (1fc79bbe6, v0.77.1) and keeping the defaultfsdeny list; the Docker config limitsfsto/clients,/downloads,/notebooks.Testing
go1.25.3:
go test ./startup/security/ok,go vet ./startup/...andgo build ./...exit 0. Mutation-checked in dmerron-r7#21.🤖 Generated with Claude Code