Align the tracked trusted-candidate-builder unit and CAP contract to the real
deployed unit (live truth over nominal), per V2R2C2 P0 §2.
- aios-trusted-candidate-builder.service: now byte-identical (LF-normalized)
to the live /etc/systemd/system unit on hw (sha256
9d194c2...). Only delta ever applied is the minimal CAP_SYS_PTRACE pair
(AmbientCapabilities + CapabilityBoundingSet). User=root/Group=root,
credential paths, socket ownership and ProtectProc/ProcSubset are untouched
from live.
- Remove the self-invented aios-trusted-candidate-builder-ptrace.service,
which invented User=aios-builder/Group=aios-gitops + ProtectProc=invisible
+ ProcSubset=pid + StateDirectoryMode — a divergence from live that §2
forbids. Drop its package-manifest entry; test asserts it is no longer
tracked.
- docs/security/trusted-builder-captrace.md: rewritten. CAP_SYS_PTRACE is now
explicitly marked a HIGH-SENSITIVITY capability (it broadens cross-uid
process inspection/debug authority), replacing the prior "grants no control
authority" understatement. Documents the live baseline and forbids
reintroducing a divergent non-root unit.
- tests/test_trusted_candidate_builder_captrace.py: drop the assume-large-pid
heuristic; State A is now modelled with monkeypatched PermissionError(EACCES)
covering cgroup -> PEER_CGROUP_UNAVAILABLE, exe -> PEER_PROCESS_UNAVAILABLE,
and cmdline -> PEER_PROCESS_UNAVAILABLE. Unit assertions now target the
live-baseline unit (User=root, no ProtectProc/ProcSubset, no -ptrace file).
- tests/test_trusted_candidate_builder.py: the POSIX-only evidence-root mode
test (COLLECTOR_EVIDENCE_ROOT_MODE_DENIED for 0770/0777) is a Linux-native
acceptance item and is now skipped on Windows (os.name != 'nt' gate in
source); verified on Linux live per §10/§15.
Windows local status: 38 passed, 1 skipped (POSIX evidence-root mode), 1
platform-boundary failure (symlink denial, WinError 1314 -> Linux live).
owner
d4f181fcf4