[knittingcode]

Summary

Restores the U-16 check that another local user cannot read a generated secret. It now lives in a separate script, tests/devenv/cross-user.sh, which runs as its own step in the Dev environment job. #43's Docker isolation of tests/devenv/unit.sh is unchanged.

Stacked on #43 (base test/fcrm-qa009-mutation-containment).

Motivation

#43 runs unit.sh under scripts/ci/no-docker.sh, where setuid programs such as sudo do not work. Because of that, the U-16 check sudo -n -u nobody cat <secret> printed INFO in CI as well, and the unit count fell from 288 to 287. Adding sudo back to the isolated suite would give mutable code a privileged step. So the check is split off:

• (a) code under test runs in the Docker isolation;
• (b) a trusted step outside it runs no code under test.

The earlier check also ran below a 0700 mktemp -d directory. nobody could not reach any file below it, so the check would have passed even with an exposed secrets directory.

Implementation

• tests/devenv/cross-user.sh (new):
  1. It refuses with exit 64 when:
     • it gets arguments;
     • DEVENV, GUARD, ADAPTED or NO_DOCKER_ACTIVE is set;
     • it does not run in a Git checkout;
     • bin/devenv, the script itself, tally.sh, no-docker.sh or no-docker-probe.py differs from HEAD.
  2. Without passwordless sudo -u nobody it prints INFO and exits 0. With CI=true it fails instead.
  3. Isolated part: the checkout's own bin/devenv (a fixed path, not taken from any input) runs ensure_secrets under no-docker.sh. Its runtime directory is a new 0755 directory below /tmp (not $TMPDIR, which is 0700 on macOS), and a fake docker reports no volume.
  4. Trusted part, outside the isolation:
     • It checks the result only as data: no symbolic links, regular files, owned by the caller, directory 0700, files 0444.
     • Then it runs /bin/ls on the secrets directory and /bin/cat on each of the four fixed secret names, as nobody.
     • Control: nobody must be able to read a 0444 file that the script creates in a 0755 directory next to the secrets directory.
     • It never changes, follows or executes a path that the isolated code could have replaced.
  5. It reports 7 results (CU-01 to CU-04) through tally.sh.
• tests/devenv/unit.sh: the sudo branch is removed. U-16 prints an INFO line that names cross-user.sh as the owner of the check. The unit count stays at 287, now by design.
• CI: a new Dev environment step, "Secrets unreadable by another local user (trusted, outside the isolation)", runs after the allocator unit tests. ShellCheck in that job now covers the script.
• Docs: in docs/dev-environment.md, "Isolation from Docker" now has a "Cross-user check of the secrets" part, the test list includes the script, and the console example shows it.

Testing performed

Local, macOS 26, in a separate worktree:

• tests/devenv/unit.sh: TOTAL 287 passed=287 failed=0, exit 0, inside the isolation. It printed INFO U-16 cross-user read check: tests/devenv/cross-user.sh (outside the isolation); permissions checked above.
• Syntax: bash -n (bash 5) and /bin/bash -n (3.2.57) pass on cross-user.sh.
• ShellCheck: 0.11.0 -x reports nothing on tests/devenv/unit.sh and tests/devenv/cross-user.sh.
• Workflow file: .github/workflows/ci.yml parses with PyYAML and the new step is in the Dev environment job. actionlint is not installed locally, so it was not run.

Not run: tests/devenv/cross-user.sh itself, so none of its paths has been executed, including the refusals, the skip, the control and the CU checks; the guard suites; no-docker.test.sh.

CI runs only for pull requests that target main, so no CI ran for this PR. It will run once this PR is retargeted to main after #43 merges, and that run is the first execution of cross-user.sh.

Security considerations

• Outside the isolation the script runs only fixed commands. With the caller's privileges it runs git, mktemp, stat and [ ] tests. As nobody it runs /bin/ls and /bin/cat. Every path is built from a mktemp directory and constant names.
• sudo is used only to lower privileges to nobody. A symbolic link planted by the isolated code is followed only by nobody, so at worst it gives a false result. It never gives access beyond what nobody already has.
• Code that runs outside the isolation never reads the contents of a secret. Error output from the isolated step is cut to 2000 bytes and reduced to printable characters before it is printed.
• The refusals keep the script from being used as a mutation harness. They protect against accidents only: a deliberate edit can remove them, and a committed mutant passes the HEAD comparison.
• git diff runs with core.fsmonitor=false, --no-ext-diff and --no-textconv.

Known limitations

• On Linux the isolated part needs passwordless sudo for no-docker.sh, as unit.sh already does. Locally on macOS the trusted part needs passwordless sudo to nobody, which is usually not set up, so the script skips there.
• An edited checkout is refused. To check local changes, commit them first.
• The script checks the four secret names it lists itself. A new secret in bin/devenv is not covered until it is added to that list.
• tests/app/stack.sh ST-34 has the same sudo -n -u nobody cat check, and its checkout copy appears to sit below a 0700 mktemp -d work directory. If so, that check passes regardless of the secrets directory mode. It is not changed here.