ward exec jail cannot self-converge become roles: no_new_privs blocks sudo, jailed ssh fails root-owned config checks #1134

New issue

Closed

opened 2026-07-12 20:15:24 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-12 20:15:24 +00:00

Member

Found while installing docker on ser8 (ward 0.630.0, Ubuntu 26.04) via infrastructure's ansible-sync verb, after the ward-apparmor userns profile unblocked the jail itself (infrastructure a3fd308).

Two independent walls stop a fleet host from self-converging become:true roles through ward:

no_new_privs vs sudo - the exec jail sets no_new_privs, so setuid sudo cannot elevate inside it. Every ansible become task on the local leg dies with 'sudo: The no new privileges flag is set'. This blocks ask_pass=1 too (the password never matters, sudo is structurally blocked), so the ansible-sync verb description's ask_pass guidance is stale for jailed local runs.
jailed ssh vs root-owned configs - on the fleet leg run from inside the jail, OpenSSH rejects /etc/ssh/ssh_config.d includes with 'Bad owner or permissions' even at root:root 0644 (verified fine unjailed). Likely the userns uid mapping presenting root-owned files as nobody-owned, failing the owner==root-or-user check. Separately, a host SSHing to itself resolves its own name to 127.0.1.1 via /etc/hosts, bypassing Tailscale SSH auth.

Net effect: privileged converges on the local host only work with the underlying command run outside ward (used for the ser8 docker install, Kai-approved). Worth deciding a supported path: a declared jail exemption for become verbs, escalation via a NNP-compatible route, or documenting fleet-push-from-another-host as the only privileged path and fixing the ansible-sync verb doc.

Found while installing docker on ser8 (ward 0.630.0, Ubuntu 26.04) via infrastructure's ansible-sync verb, after the ward-apparmor userns profile unblocked the jail itself (infrastructure a3fd308). Two independent walls stop a fleet host from self-converging become:true roles through ward: * no_new_privs vs sudo - the exec jail sets no_new_privs, so setuid sudo cannot elevate inside it. Every ansible become task on the local leg dies with 'sudo: The no new privileges flag is set'. This blocks ask_pass=1 too (the password never matters, sudo is structurally blocked), so the ansible-sync verb description's ask_pass guidance is stale for jailed local runs. * jailed ssh vs root-owned configs - on the fleet leg run from inside the jail, OpenSSH rejects /etc/ssh/ssh_config.d includes with 'Bad owner or permissions' even at root:root 0644 (verified fine unjailed). Likely the userns uid mapping presenting root-owned files as nobody-owned, failing the owner==root-or-user check. Separately, a host SSHing to itself resolves its own name to 127.0.1.1 via /etc/hosts, bypassing Tailscale SSH auth. Net effect: privileged converges on the local host only work with the underlying command run outside ward (used for the ser8 docker install, Kai-approved). Worth deciding a supported path: a declared jail exemption for become verbs, escalation via a NNP-compatible route, or documenting fleet-push-from-another-host as the only privileged path and fixing the ansible-sync verb doc.

coilyco-ops commented

2026-07-13 03:40:46 +00:00

Author

Member

WARD-RESERVATION: held 🔒

reservation details

Holder: container engineer-codex-ward-1134 on host KAI-DESKTOP-TOWER.

Reserved by ward agent --harness codex (reserved 2026-07-13T03:40:42Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/ward#1134 · branch issue-1134 · harness codex · workflow pull-request-and-merge
Run: engineer-codex-ward-1134 · ward v0.633.0 · dispatched 2026-07-13T03:40:42Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.633.0).

— Codex, via ward agent

WARD-RESERVATION: held 🔒 <details><summary>reservation details</summary> Holder: container `engineer-codex-ward-1134` on host `KAI-DESKTOP-TOWER`. Reserved by `ward agent --harness codex` (reserved 2026-07-13T03:40:42Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/ward#1134` · branch `issue-1134` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-ward-1134` · ward `v0.633.0` · dispatched `2026-07-13T03:40:42Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.633.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-13 03:51:44 +00:00

docs: clarify exec jail privilege limits #1159

coilyco-ops commented

2026-07-13 03:52:59 +00:00

Author

Member

WARD-OUTCOME: submitted

details

workflow: pull-request-and-merge; review summary: skipped (review gate intentionally skipped because the temporary ward default pending brokered QA)
retrospective: the fix was narrow, and the docs now name the jail limitation directly.
confidence: high
surprise: the code-comment hook forced a shorter helper comment than the first draft.
follow-up: none.

WARD-OUTCOME: submitted <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped (review gate intentionally skipped because the temporary ward default pending brokered QA) retrospective: the fix was narrow, and the docs now name the jail limitation directly. confidence: high surprise: the code-comment hook forced a shorter helper comment than the first draft. follow-up: none. </details>

coilyco-ops closed this issue

2026-07-13 03:53:13 +00:00