aios/aios

Files

T

Codex 9577613497 fix(openclaw): harden B3 evidence trust and path boundaries

Complete security hardening for B3 evidence collection tool:

Security fixes:
1. Ancestor symlink path escape prevention - reject_symlink_chain()
2. Add external Trust Policy with --trust-policy flag, schema validation,
   and file permission checks (600/400 for trust policy)
3. Authority present: false or missing now hard-fails (was soft-fail)
4. Self-review rejection - reviewer must differ from capture/credential
5. SSH signature verification with ssh-keygen -Y verify
6. SFTP trust policy delivery verification
7. Reject_Float nan/infinity in JSON parsing
8. JSON key duplication detection
9. Dirfd atomic writes with O_DIRECTORY|O_NOFOLLOW parent fd

Documentation:
- Updated facts template with trust_policy_key field
- Updated README with new trust policy and security features
- Updated task file with completed verification step

Testing:
- PoC test suite in tools/personal_weixin/tests/ covers:
  - symlink ancestor chain detection
  - authority present:false hard fail
  - self-review rejection (same as capture, same as credential)
  - authority missing present key
  - trust policy permissive permissions rejection
  - trust policy missing/invalid/schema validation failures

No gitleaks findings in modified files.

2026-07-16 15:37:46 +08:00

3.3 KiB

Raw Blame History

B3 Evidence Collection — Security Hardened

Overview

This tool generates and validates B3 (Burden-3) evidence files for the OpenClaw WeChat messaging pipeline. It implements the following security hardening measures:

1. Ancestor Symlink Path Escape Prevention (`_reject_symlink_chain`)

A new helper _reject_symlink_chain(path, field) checks every ancestor component of a given path — rejecting the path if any component is a symbolic link. This prevents TOCTOU (time-of-check/time-of-use) path-escalation attacks where an attacker replaces a directory component with a symlink between validation and access.

2. Dirfd Atomic Writes (`_open_parent_dirfd`, `_write_via_dirfd`)

Evidence file writes now use the parent directory's file descriptor (opened with O_RDONLY|O_DIRECTORY|O_NOFOLLOW) for atomic temporary-file renames, preventing the classic symlink-rename TOCTOU pattern.

3. External Trust Policy (`--trust-policy`)

A new --trust-policy PATH argument validates an external JSON policy file containing:

Strict permission check: file must have permissions 0o600 or tighter
Schema validation: enforces expected keys (version, allowed_credentials, allowed_institutions, max_age_days)
Rejection on: missing file, non-file path, permissive permissions, or invalid JSON

4. SSH Signature Verification via `ssh-keygen -Y verify`

The _verify_ssh_signature() method verifies capture, credential, and reviewer attestations using the command-line tool ssh-keygen -Y verify. It invokes the standard SSH signature verification protocol, providing:

The identity name to verify against
The signature payload
The allowed signers file from credential_path
Returns hard failure on missing, malformed, or invalid signatures

5. Authority Hard Fail (`present: false` or missing)

The _check_authority() method performs a hard fail (script exit with BLOCKED) if:

The authority.present key is missing from the evidence JSON
The authority.present value is false
Any expected authority key is missing

6. Self-Review Rejection

The _check_self_review() method rejects any evidence where the reviewer_identity.name matches either the capture_identity.name or credential_identity.name. This enforces mandatory separation of duties between capture, credential, and reviewer roles.

7. Updated Template, README, and Task Files

The evidence template (pwx_b3_evidence_facts.template.json) has been updated to include the new present field (defaults to true). This README documents all security features. The task file records the hardening execution.

Usage

# Validate only
python3 pwx_b3_evidence_tool.py evidence.json --trust-policy trust-policy.json --validate-only

# Collect only
python3 pwx_b3_evidence_tool.py evidence.json --trust-policy trust-policy.json --collect-only

# Full submit (validate + collect)
python3 pwx_b3_evidence_tool.py evidence.json --trust-policy trust-policy.json

File Layout

pwx_b3_evidence_tool.py — Security-hardened B3 evidence collection tool
pwx_b3_evidence_facts.template.json — Evidence JSON template (updated with present field)
README-B3-EVIDENCE.md — This file
.agent/tasks/codex/TASK-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-COLLECT-20260716.md — Task file

3.3 KiB Raw Blame History