docs(buglog): log P0 defects from the 2026-10-10 review (bug-1936..bug-1952)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
parent
94472ee3e7
commit
2fed7a6e5f
GPG key ID:
80533536B0EB651C
18 changed files with 1258 additions and 0 deletions
|
|
@ -17812,6 +17812,401 @@
|
|||
"record": ".wolf/bugs/bug-1935.md",
|
||||
"gitea_issue": 360,
|
||||
"gitea_synced_status": "fixed"
|
||||
},
|
||||
{
|
||||
"id": "bug-1936",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "apiserver",
|
||||
"severity": "wrong-result",
|
||||
"timestamp": "2026-10-10T08:14:36Z",
|
||||
"last_seen": "2026-10-10T08:14:36Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "apiserver drops cwd, env, run/resource limits, file transfers and I/O paths of REST job submissions\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n`modelJobToSubmit()` (`src/frontend/apiserver/backend/convert.go:323-375`) builds the controller's `job_startinfo_t` with only cmdline, execuser, launch_type and pre/post-exec; it never sets `exdata`, `exechome` or `execcwd`:\n```go\nsi := (*C.job_startinfo_t)(C.calloc(1, C.sizeof_job_startinfo_t))\nsi.cmdline = C.CString(job.Command)\n... // no si.exdata / si.exechome / si.execcwd\n```\nSo `--cwd`, `--env`, `--file` transfers, interactive mode, every `*_limit` flag (incl. `-W` run limit), `-i/-o/-e`, asked hosts and begin/end time are kept only in the apiserver's memory and never reach the controller or the worker.\n\n**Expected:** Every submit option the apiserver accepts reaches the worker in the job's start info (exdata, exec home, cwd), or is rejected as unsupported.\n**Impact:** Silent wrong result: jobs run without the limits, environment, working directory and I/O paths the user asked for (e.g. a `-W` run limit is never enforced).\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/frontend/apiserver/backend/convert.go, src/frontend/apiserver/controllers/jobs.go",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"apiserver",
|
||||
"submit",
|
||||
"exdata",
|
||||
"limits"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1936.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1937",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "worker",
|
||||
"severity": "wrong-result",
|
||||
"timestamp": "2026-10-10T08:14:38Z",
|
||||
"last_seen": "2026-10-10T08:14:38Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "apiserver writes job file transfers under 'transfer_files' but the worker parses 'transfer_file'\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe apiserver serialises transfers as `extendDataMap[\"transfer_files\"]` (`src/frontend/apiserver/controllers/jobs.go:1923`) while the worker looks for:\n```c\nelse if (strcmp(key, \"transfer_file\") == 0) { /* xcecd_exdata.c:115 */\n```\n\n**Expected:** Both sides use one key, so transfers in exdata are parsed.\n**Impact:** Wrong result once exdata reaches the worker: file transfers are silently ignored.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/frontend/apiserver/controllers/jobs.go, src/worker/src/xcecd_exdata.c",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"apiserver",
|
||||
"worker",
|
||||
"exdata",
|
||||
"file-transfer"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1937.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1938",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "scheduler",
|
||||
"severity": "wrong-result",
|
||||
"timestamp": "2026-10-10T08:14:41Z",
|
||||
"last_seen": "2026-10-10T08:14:41Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "xce_scheduler dispatches jobs from closed or inactive queues (queue readiness gate is a stub)\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe admin queue controls set and clear the closed/inactive flags (`src/controller/queue.c:131-152`), but the scheduler's gates always pass:\n```c\n/* FIXME this is just stub, we need to add more */\nint sched_job_is_ready(xce_sched_job_t* j) { return 1; }\n/* FIXME this is just stub, we need to add more */\nint sched_queue_is_ready(xce_sched_queue_t* q) { return 1; } /* core.c:646-649 */\n```\n\n**Expected:** Jobs of an inactive queue are not dispatched (they stay pending with a reason); a closed queue accepts no new submissions.\n**Impact:** Admin queue control silently ignored: inactivating a queue does not stop dispatch.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/scheduler/src/core.c, src/scheduler/src/plugins/builtin_fcfs.c",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"scheduler",
|
||||
"queue",
|
||||
"admin-control"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1938.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1939",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "scheduler",
|
||||
"severity": "wrong-result",
|
||||
"timestamp": "2026-10-10T08:14:43Z",
|
||||
"last_seen": "2026-10-10T08:14:43Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "xce_scheduler dispatches jobs to hosts closed by an admin\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nHost close sets `XCE_WORKER_CLOSED|XCE_WORKER_CLOSED_BY_ADMIN` (`src/controller/worker.c:1015-1024`), but no scheduler code checks either bit (only unavailable/reconciling hosts are skipped: `core_session.c:136`, `resource.c:704,887`); the parallel allocator's bad-host check is empty (`plugins/parjob_allocator.c:40-48`).\n\n**Expected:** A closed host gets no new jobs; running jobs are unaffected.\n**Impact:** Admin host control silently ignored: closing a host for maintenance does not stop new jobs landing on it.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/scheduler/src/resource.c, src/scheduler/src/core_session.c, src/scheduler/src/plugins/parjob_allocator.c",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"scheduler",
|
||||
"host",
|
||||
"admin-control"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1939.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1940",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "apiserver",
|
||||
"severity": "wrong-result",
|
||||
"timestamp": "2026-10-10T08:14:46Z",
|
||||
"last_seen": "2026-10-10T08:14:46Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "job control ignores the requested signal and the force-kill flag (apiserver to controller)\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe control handler passes a JSON event string as content (`controllers/jobs.go:2260-2277`); `signalNumber()` looks it up as a signal name, fails and falls back to TERM/TSTP/CONT; `backend/clib.go:697-705` always sends `sig.force = 0` and `ckpt.kill = 0`, dropping ForceKill and the checkpoint kill/method options (`:746-762`).\n\n**Expected:** A kill with a user-chosen signal sends that signal; force kill and checkpoint options reach the controller.\n**Impact:** Wrong result: users cannot send a specific signal or force-kill a job.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/frontend/apiserver/controllers/jobs.go, src/frontend/apiserver/backend/clib.go",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"apiserver",
|
||||
"job-control",
|
||||
"signal"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1940.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1941",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "controller",
|
||||
"severity": "wrong-result",
|
||||
"timestamp": "2026-10-10T08:14:48Z",
|
||||
"last_seen": "2026-10-10T08:14:48Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "xce_controller refuses kill/stop/resume of running jobs on hosts whose status is not exactly OK\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n```c\n/* FIXME: better method to check host status */\nif (w->ep && w->host.status == 0) { /* src/controller/job.c:2145-2156 */\n```\nAny other status bit (CLOSED_BY_ADMIN, BUSY, UNAVAIL...) makes the control request fail.\n\n**Expected:** Jobs on a closed (or otherwise flagged but connected) host can be killed, stopped and resumed; a host that is not connected gives a clear error.\n**Impact:** Users and admins cannot kill jobs on a host closed for maintenance.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/controller/job.c",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"controller",
|
||||
"job-control",
|
||||
"host-status"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1941.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1942",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "controller",
|
||||
"severity": "wrong-result",
|
||||
"timestamp": "2026-10-10T08:14:51Z",
|
||||
"last_seen": "2026-10-10T08:14:51Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "xce_controller sends job control of a multi-host job only to its first host\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nJob control is routed to `allocs[0]->host` only (`src/controller/job.c:2126-2131`).\n\n**Expected:** Signals reach every host of the job (or the job's launcher is documented to fan them out and does so).\n**Impact:** Suspending or killing a multi-host job can leave its tasks on other hosts running.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/controller/job.c",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"controller",
|
||||
"job-control",
|
||||
"parallel"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1942.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1943",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "scheduler",
|
||||
"severity": "wrong-result",
|
||||
"timestamp": "2026-10-10T08:14:54Z",
|
||||
"last_seen": "2026-10-10T08:14:54Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "xce_scheduler --sim does not load user and host groups, so group-scoped limits differ from live\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nOn a config push the live scheduler loads user and host groups (`groupmgr_load_configs`, `src/scheduler/src/scheduler.c:1144-1145`); the core's config event used by the simulator applies only resources, resource values and queues (`core_events.c:846-850`).\n\n**Expected:** Live and simulated scheduling apply the same groups (scheduler-driver-equivalence.md).\n**Impact:** Replays of clusters with group-scoped limits make different decisions than the live scheduler.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/scheduler/src/core_events.c, src/scheduler/src/scheduler.c",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"scheduler",
|
||||
"sim",
|
||||
"equivalence",
|
||||
"limit"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1943.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1944",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "scheduler",
|
||||
"severity": "wrong-result",
|
||||
"timestamp": "2026-10-10T08:14:56Z",
|
||||
"last_seen": "2026-10-10T08:14:56Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "xce_scheduler gives a job moved to another queue the queue's priority, so it jumps ahead\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nNew jobs get priority 0 (`schedobj.c:214`, `core_events.c:353`), but on a queue change the job's priority becomes the queue's priority (`core_events.c:1360`, `schedobj.c:684`); the picker sorts by job priority within a queue (`plugins/builtin_fcfs.c:213`).\n\n**Expected:** Moving a job does not change its job priority.\n**Impact:** Wrong ordering: moved jobs overtake jobs submitted earlier to the target queue.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/scheduler/src/core_events.c, src/scheduler/src/schedobj.c",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"scheduler",
|
||||
"queue",
|
||||
"priority"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1944.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1945",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "apiserver",
|
||||
"severity": "security",
|
||||
"timestamp": "2026-10-10T08:14:59Z",
|
||||
"last_seen": "2026-10-10T08:14:59Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "apiserver signs and accepts JWTs with the shipped default secret when XCE_JWT_SECRET is unset\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n`config/app.yaml:17` ships the secret `xce-api-key`; `utils/config.go:315-320` uses `XCE_JWT_SECRET` when set and otherwise keeps the default without any warning.\n\n**Expected:** The apiserver never runs with a publicly known signing secret.\n**Impact:** Security: anyone can forge tokens for any user on a deployment that did not set the environment variable.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/frontend/apiserver/config/app.yaml, src/frontend/apiserver/utils/config.go",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"apiserver",
|
||||
"security",
|
||||
"jwt"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1945.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1946",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "apiserver",
|
||||
"severity": "security",
|
||||
"timestamp": "2026-10-10T08:15:01Z",
|
||||
"last_seen": "2026-10-10T08:15:01Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "apiserver logout does not revoke the token: it stays valid until expiry\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nLogout deletes a token file (`controllers/auth.go:69-95`) that token validation never reads (`middleware/validatehandler.go:101-116`).\n\n**Expected:** After logout the token is rejected.\n**Impact:** Security: a leaked token keeps working for up to 24 h after logout.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/frontend/apiserver/controllers/auth.go, src/frontend/apiserver/middleware/validatehandler.go",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"apiserver",
|
||||
"security",
|
||||
"jwt"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1946.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1947",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "apiserver",
|
||||
"severity": "security",
|
||||
"timestamp": "2026-10-10T08:15:04Z",
|
||||
"last_seen": "2026-10-10T08:15:04Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "apiserver config-file auth compares plaintext passwords with != and ships admin/admin defaults\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n`backend/auth/config_file.go:60` compares the stored plaintext password with `!=`; `config/auth.yaml:12-21` ships `admin/admin` and `user1/user1`.\n\n**Expected:** Stored passwords are hashed and compared in constant time; no default credentials are shipped active.\n**Impact:** Security: password disclosure from the config file, timing side channel, and known default credentials.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/frontend/apiserver/backend/auth/config_file.go, src/frontend/apiserver/config/auth.yaml",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"apiserver",
|
||||
"security",
|
||||
"auth"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1947.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1948",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "apiserver",
|
||||
"severity": "security",
|
||||
"timestamp": "2026-10-10T08:15:06Z",
|
||||
"last_seen": "2026-10-10T08:15:06Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "apiserver trusts X-Forwarded-For from any client, so IP whitelist and JWT IP binding can be spoofed\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe router uses `gin.Default()` (`router/routers.go:19`) and never calls `SetTrustedProxies`, so `ClientIP()` honours `X-Forwarded-For` from any peer.\n\n**Expected:** Forwarded headers are only honoured from configured trusted proxies.\n**Impact:** Security: a client can claim any IP and bypass the IP whitelist and the IP bound into its JWT.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/frontend/apiserver/router/routers.go",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"apiserver",
|
||||
"security",
|
||||
"whitelist"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1948.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1949",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "apiserver",
|
||||
"severity": "security",
|
||||
"timestamp": "2026-10-10T08:15:09Z",
|
||||
"last_seen": "2026-10-10T08:15:09Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "apiserver RequirePermission and IP whitelist write an error but do not abort the request\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nOn a bad token `RequirePermission` returns an error response without `Abort()` (`controllers/rbac_check.go:119-122`); the IP whitelist does the same for an invalid client IP (`middleware/whitelist.go:130-132`); `ReturnError` never aborts (`controllers/response.go:30-37`).\n\n**Expected:** A failed middleware check stops the request before the handler runs.\n**Impact:** Security: the handler may still run after an authorization failure.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/frontend/apiserver/controllers/rbac_check.go, src/frontend/apiserver/middleware/whitelist.go, src/frontend/apiserver/controllers/response.go",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"apiserver",
|
||||
"security",
|
||||
"middleware"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1949.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1950",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "apiserver",
|
||||
"severity": "security",
|
||||
"timestamp": "2026-10-10T08:15:11Z",
|
||||
"last_seen": "2026-10-10T08:15:11Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "apiserver JWT validation does not pin the signing algorithm\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nThe middleware's parse callback returns the key without checking `token.Method` (`middleware/validatehandler.go:102-104`), unlike the other parse path (`controllers/auth.go:186`).\n\n**Expected:** Only the configured HMAC algorithm is accepted.\n**Impact:** Security hardening: algorithm-confusion class of attacks is not ruled out.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/frontend/apiserver/middleware/validatehandler.go",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"apiserver",
|
||||
"security",
|
||||
"jwt"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1950.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1951",
|
||||
"status": "open",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "newly logged",
|
||||
"component": "apiserver",
|
||||
"severity": "crash",
|
||||
"timestamp": "2026-10-10T08:15:14Z",
|
||||
"last_seen": "2026-10-10T08:15:14Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "apiserver crashes on an auth.yaml without a config_file block (nil pointer)\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\n`backend/auth/config_file.go:39` reads `cfg.ConfigFile.Users` without checking `cfg.ConfigFile` for nil.\n\n**Expected:** A missing block is a clear configuration error, not a panic.\n**Impact:** Crash at startup or login with a minimal auth.yaml.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/frontend/apiserver/backend/auth/config_file.go",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"apiserver",
|
||||
"auth",
|
||||
"config",
|
||||
"crash"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1951.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1952",
|
||||
"status": "investigating",
|
||||
"status_updated": "2026-10-10",
|
||||
"status_note": "suspected from source reading; confirm with a test before fixing",
|
||||
"component": "apiserver",
|
||||
"severity": "security",
|
||||
"timestamp": "2026-10-10T08:15:16Z",
|
||||
"last_seen": "2026-10-10T08:15:16Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "apiserver user role changes check a narrower rbac:control grant only against the target user\n\n**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)\nSuspected (needs verification): in add/delete roles for a user, a non-`all` `rbac:control` grant is only checked against \"is the target me?\" (`controllers/users.go:404-412,455-462`), so such a grant could let a user give itself `cluster_admin`. Built-in roles grant `rbac:control` only with domain `all` (`config/rbac.yaml:100-102`), so this is latent.\n\n**Expected:** A user can never grant itself a role with more rights than it already holds.\n**Impact:** Security (latent): privilege escalation through a custom role.\n**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)",
|
||||
"file": "src/frontend/apiserver/controllers/users.go",
|
||||
"root_cause": "TODO: required for fixed/partial",
|
||||
"fix": "TODO: required for fixed/partial\n\nVerification:\n- Test: TODO: name + file; RED before the fix, GREEN after\n- Suites: TODO: suite results and build profile\n- Live: TODO: soak/deploy run, or n/a and why",
|
||||
"tags": [
|
||||
"apiserver",
|
||||
"security",
|
||||
"rbac"
|
||||
],
|
||||
"related_bugs": [],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1952.md"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
|
|||
56
.wolf/bugs/bug-1936.md
Normal file
56
.wolf/bugs/bug-1936.md
Normal file
|
|
@ -0,0 +1,56 @@
|
|||
---
|
||||
id: "bug-1936"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "apiserver"
|
||||
severity: "wrong-result"
|
||||
timestamp: "2026-10-10T08:14:36Z"
|
||||
last_seen: "2026-10-10T08:14:36Z"
|
||||
occurrences: 1
|
||||
files: ["src/frontend/apiserver/backend/convert.go", "src/frontend/apiserver/controllers/jobs.go"]
|
||||
tags: ["apiserver", "submit", "exdata", "limits"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1936: apiserver drops cwd, env, run/resource limits, file transfers and I/O paths of REST job submissions
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
`modelJobToSubmit()` (`src/frontend/apiserver/backend/convert.go:323-375`) builds the controller's `job_startinfo_t` with only cmdline, execuser, launch_type and pre/post-exec; it never sets `exdata`, `exechome` or `execcwd`:
|
||||
```go
|
||||
si := (*C.job_startinfo_t)(C.calloc(1, C.sizeof_job_startinfo_t))
|
||||
si.cmdline = C.CString(job.Command)
|
||||
... // no si.exdata / si.exechome / si.execcwd
|
||||
```
|
||||
So `--cwd`, `--env`, `--file` transfers, interactive mode, every `*_limit` flag (incl. `-W` run limit), `-i/-o/-e`, asked hosts and begin/end time are kept only in the apiserver's memory and never reach the controller or the worker.
|
||||
|
||||
**Expected:** Every submit option the apiserver accepts reaches the worker in the job's start info (exdata, exec home, cwd), or is rejected as unsupported.
|
||||
**Impact:** Silent wrong result: jobs run without the limits, environment, working directory and I/O paths the user asked for (e.g. a `-W` run limit is never enforced).
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Submit through REST/xcecli with `xcecli jobs submit -W 1 --cwd /tmp --env A=1 sleep 120` on any deployment.
|
||||
2. Inspect the job's start info at the worker (worker log of the launched unit) or the controller's `job.start_info`: no exdata, no cwd; the job runs past one minute.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
52
.wolf/bugs/bug-1937.md
Normal file
52
.wolf/bugs/bug-1937.md
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
---
|
||||
id: "bug-1937"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "worker"
|
||||
severity: "wrong-result"
|
||||
timestamp: "2026-10-10T08:14:38Z"
|
||||
last_seen: "2026-10-10T08:14:38Z"
|
||||
occurrences: 1
|
||||
files: ["src/frontend/apiserver/controllers/jobs.go", "src/worker/src/xcecd_exdata.c"]
|
||||
tags: ["apiserver", "worker", "exdata", "file-transfer"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1937: apiserver writes job file transfers under 'transfer_files' but the worker parses 'transfer_file'
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
The apiserver serialises transfers as `extendDataMap["transfer_files"]` (`src/frontend/apiserver/controllers/jobs.go:1923`) while the worker looks for:
|
||||
```c
|
||||
else if (strcmp(key, "transfer_file") == 0) { /* xcecd_exdata.c:115 */
|
||||
```
|
||||
|
||||
**Expected:** Both sides use one key, so transfers in exdata are parsed.
|
||||
**Impact:** Wrong result once exdata reaches the worker: file transfers are silently ignored.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Read the two sites above; or unit-test `parse_exdata()` with the JSON the apiserver produces: `transfer_info->ops` stays empty.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
56
.wolf/bugs/bug-1938.md
Normal file
56
.wolf/bugs/bug-1938.md
Normal file
|
|
@ -0,0 +1,56 @@
|
|||
---
|
||||
id: "bug-1938"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "scheduler"
|
||||
severity: "wrong-result"
|
||||
timestamp: "2026-10-10T08:14:41Z"
|
||||
last_seen: "2026-10-10T08:14:41Z"
|
||||
occurrences: 1
|
||||
files: ["src/scheduler/src/core.c", "src/scheduler/src/plugins/builtin_fcfs.c"]
|
||||
tags: ["scheduler", "queue", "admin-control"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1938: xce_scheduler dispatches jobs from closed or inactive queues (queue readiness gate is a stub)
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
The admin queue controls set and clear the closed/inactive flags (`src/controller/queue.c:131-152`), but the scheduler's gates always pass:
|
||||
```c
|
||||
/* FIXME this is just stub, we need to add more */
|
||||
int sched_job_is_ready(xce_sched_job_t* j) { return 1; }
|
||||
/* FIXME this is just stub, we need to add more */
|
||||
int sched_queue_is_ready(xce_sched_queue_t* q) { return 1; } /* core.c:646-649 */
|
||||
```
|
||||
|
||||
**Expected:** Jobs of an inactive queue are not dispatched (they stay pending with a reason); a closed queue accepts no new submissions.
|
||||
**Impact:** Admin queue control silently ignored: inactivating a queue does not stop dispatch.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Deploy a cluster, inactivate queue `normal` (queue control), submit a job to it.
|
||||
2. The job is dispatched and runs.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
50
.wolf/bugs/bug-1939.md
Normal file
50
.wolf/bugs/bug-1939.md
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
id: "bug-1939"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "scheduler"
|
||||
severity: "wrong-result"
|
||||
timestamp: "2026-10-10T08:14:43Z"
|
||||
last_seen: "2026-10-10T08:14:43Z"
|
||||
occurrences: 1
|
||||
files: ["src/scheduler/src/resource.c", "src/scheduler/src/core_session.c", "src/scheduler/src/plugins/parjob_allocator.c"]
|
||||
tags: ["scheduler", "host", "admin-control"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1939: xce_scheduler dispatches jobs to hosts closed by an admin
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
Host close sets `XCE_WORKER_CLOSED|XCE_WORKER_CLOSED_BY_ADMIN` (`src/controller/worker.c:1015-1024`), but no scheduler code checks either bit (only unavailable/reconciling hosts are skipped: `core_session.c:136`, `resource.c:704,887`); the parallel allocator's bad-host check is empty (`plugins/parjob_allocator.c:40-48`).
|
||||
|
||||
**Expected:** A closed host gets no new jobs; running jobs are unaffected.
|
||||
**Impact:** Admin host control silently ignored: closing a host for maintenance does not stop new jobs landing on it.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Close a host (`xcecli hosts close <h>`), submit jobs that fit it.
|
||||
2. Jobs are dispatched to the closed host.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
50
.wolf/bugs/bug-1940.md
Normal file
50
.wolf/bugs/bug-1940.md
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
id: "bug-1940"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "apiserver"
|
||||
severity: "wrong-result"
|
||||
timestamp: "2026-10-10T08:14:46Z"
|
||||
last_seen: "2026-10-10T08:14:46Z"
|
||||
occurrences: 1
|
||||
files: ["src/frontend/apiserver/controllers/jobs.go", "src/frontend/apiserver/backend/clib.go"]
|
||||
tags: ["apiserver", "job-control", "signal"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1940: job control ignores the requested signal and the force-kill flag (apiserver to controller)
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
The control handler passes a JSON event string as content (`controllers/jobs.go:2260-2277`); `signalNumber()` looks it up as a signal name, fails and falls back to TERM/TSTP/CONT; `backend/clib.go:697-705` always sends `sig.force = 0` and `ckpt.kill = 0`, dropping ForceKill and the checkpoint kill/method options (`:746-762`).
|
||||
|
||||
**Expected:** A kill with a user-chosen signal sends that signal; force kill and checkpoint options reach the controller.
|
||||
**Impact:** Wrong result: users cannot send a specific signal or force-kill a job.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. `POST /xce/v1/jobs/<id>/control` with action kill, signal `SIGUSR1`, force_kill true.
|
||||
2. The controller receives TERM with force 0.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
54
.wolf/bugs/bug-1941.md
Normal file
54
.wolf/bugs/bug-1941.md
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
---
|
||||
id: "bug-1941"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "controller"
|
||||
severity: "wrong-result"
|
||||
timestamp: "2026-10-10T08:14:48Z"
|
||||
last_seen: "2026-10-10T08:14:48Z"
|
||||
occurrences: 1
|
||||
files: ["src/controller/job.c"]
|
||||
tags: ["controller", "job-control", "host-status"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1941: xce_controller refuses kill/stop/resume of running jobs on hosts whose status is not exactly OK
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
```c
|
||||
/* FIXME: better method to check host status */
|
||||
if (w->ep && w->host.status == 0) { /* src/controller/job.c:2145-2156 */
|
||||
```
|
||||
Any other status bit (CLOSED_BY_ADMIN, BUSY, UNAVAIL...) makes the control request fail.
|
||||
|
||||
**Expected:** Jobs on a closed (or otherwise flagged but connected) host can be killed, stopped and resumed; a host that is not connected gives a clear error.
|
||||
**Impact:** Users and admins cannot kill jobs on a host closed for maintenance.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Run a job on host h, close h, kill the job.
|
||||
2. The kill is refused.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
50
.wolf/bugs/bug-1942.md
Normal file
50
.wolf/bugs/bug-1942.md
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
id: "bug-1942"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "controller"
|
||||
severity: "wrong-result"
|
||||
timestamp: "2026-10-10T08:14:51Z"
|
||||
last_seen: "2026-10-10T08:14:51Z"
|
||||
occurrences: 1
|
||||
files: ["src/controller/job.c"]
|
||||
tags: ["controller", "job-control", "parallel"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1942: xce_controller sends job control of a multi-host job only to its first host
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
Job control is routed to `allocs[0]->host` only (`src/controller/job.c:2126-2131`).
|
||||
|
||||
**Expected:** Signals reach every host of the job (or the job's launcher is documented to fan them out and does so).
|
||||
**Impact:** Suspending or killing a multi-host job can leave its tasks on other hosts running.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Run a 2-host job (e.g. `/xce-test-multihost`), stop it.
|
||||
2. Tasks on the second host keep running.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
50
.wolf/bugs/bug-1943.md
Normal file
50
.wolf/bugs/bug-1943.md
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
id: "bug-1943"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "scheduler"
|
||||
severity: "wrong-result"
|
||||
timestamp: "2026-10-10T08:14:54Z"
|
||||
last_seen: "2026-10-10T08:14:54Z"
|
||||
occurrences: 1
|
||||
files: ["src/scheduler/src/core_events.c", "src/scheduler/src/scheduler.c"]
|
||||
tags: ["scheduler", "sim", "equivalence", "limit"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1943: xce_scheduler --sim does not load user and host groups, so group-scoped limits differ from live
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
On a config push the live scheduler loads user and host groups (`groupmgr_load_configs`, `src/scheduler/src/scheduler.c:1144-1145`); the core's config event used by the simulator applies only resources, resource values and queues (`core_events.c:846-850`).
|
||||
|
||||
**Expected:** Live and simulated scheduling apply the same groups (scheduler-driver-equivalence.md).
|
||||
**Impact:** Replays of clusters with group-scoped limits make different decisions than the live scheduler.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Record a session with a limit scoped to a user group, replay it with `xce_scheduler --sim`.
|
||||
2. The limit does not match the group's users in sim.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
50
.wolf/bugs/bug-1944.md
Normal file
50
.wolf/bugs/bug-1944.md
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
id: "bug-1944"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "scheduler"
|
||||
severity: "wrong-result"
|
||||
timestamp: "2026-10-10T08:14:56Z"
|
||||
last_seen: "2026-10-10T08:14:56Z"
|
||||
occurrences: 1
|
||||
files: ["src/scheduler/src/core_events.c", "src/scheduler/src/schedobj.c"]
|
||||
tags: ["scheduler", "queue", "priority"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1944: xce_scheduler gives a job moved to another queue the queue's priority, so it jumps ahead
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
New jobs get priority 0 (`schedobj.c:214`, `core_events.c:353`), but on a queue change the job's priority becomes the queue's priority (`core_events.c:1360`, `schedobj.c:684`); the picker sorts by job priority within a queue (`plugins/builtin_fcfs.c:213`).
|
||||
|
||||
**Expected:** Moving a job does not change its job priority.
|
||||
**Impact:** Wrong ordering: moved jobs overtake jobs submitted earlier to the target queue.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Two jobs pending in queue B; move a third job from A to B (queue priority > 0).
|
||||
2. The moved job is picked first.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
50
.wolf/bugs/bug-1945.md
Normal file
50
.wolf/bugs/bug-1945.md
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
id: "bug-1945"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "apiserver"
|
||||
severity: "security"
|
||||
timestamp: "2026-10-10T08:14:59Z"
|
||||
last_seen: "2026-10-10T08:14:59Z"
|
||||
occurrences: 1
|
||||
files: ["src/frontend/apiserver/config/app.yaml", "src/frontend/apiserver/utils/config.go"]
|
||||
tags: ["apiserver", "security", "jwt"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1945: apiserver signs and accepts JWTs with the shipped default secret when XCE_JWT_SECRET is unset
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
`config/app.yaml:17` ships the secret `xce-api-key`; `utils/config.go:315-320` uses `XCE_JWT_SECRET` when set and otherwise keeps the default without any warning.
|
||||
|
||||
**Expected:** The apiserver never runs with a publicly known signing secret.
|
||||
**Impact:** Security: anyone can forge tokens for any user on a deployment that did not set the environment variable.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Start the apiserver without `XCE_JWT_SECRET`.
|
||||
2. Sign a token with `xce-api-key` for user `admin`: it is accepted.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
50
.wolf/bugs/bug-1946.md
Normal file
50
.wolf/bugs/bug-1946.md
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
id: "bug-1946"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "apiserver"
|
||||
severity: "security"
|
||||
timestamp: "2026-10-10T08:15:01Z"
|
||||
last_seen: "2026-10-10T08:15:01Z"
|
||||
occurrences: 1
|
||||
files: ["src/frontend/apiserver/controllers/auth.go", "src/frontend/apiserver/middleware/validatehandler.go"]
|
||||
tags: ["apiserver", "security", "jwt"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1946: apiserver logout does not revoke the token: it stays valid until expiry
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
Logout deletes a token file (`controllers/auth.go:69-95`) that token validation never reads (`middleware/validatehandler.go:101-116`).
|
||||
|
||||
**Expected:** After logout the token is rejected.
|
||||
**Impact:** Security: a leaked token keeps working for up to 24 h after logout.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Log in, log out, call any API with the old token.
|
||||
2. The call succeeds.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
49
.wolf/bugs/bug-1947.md
Normal file
49
.wolf/bugs/bug-1947.md
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
---
|
||||
id: "bug-1947"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "apiserver"
|
||||
severity: "security"
|
||||
timestamp: "2026-10-10T08:15:04Z"
|
||||
last_seen: "2026-10-10T08:15:04Z"
|
||||
occurrences: 1
|
||||
files: ["src/frontend/apiserver/backend/auth/config_file.go", "src/frontend/apiserver/config/auth.yaml"]
|
||||
tags: ["apiserver", "security", "auth"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1947: apiserver config-file auth compares plaintext passwords with != and ships admin/admin defaults
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
`backend/auth/config_file.go:60` compares the stored plaintext password with `!=`; `config/auth.yaml:12-21` ships `admin/admin` and `user1/user1`.
|
||||
|
||||
**Expected:** Stored passwords are hashed and compared in constant time; no default credentials are shipped active.
|
||||
**Impact:** Security: password disclosure from the config file, timing side channel, and known default credentials.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Read `config/auth.yaml`; log in as admin/admin on a default deployment.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
50
.wolf/bugs/bug-1948.md
Normal file
50
.wolf/bugs/bug-1948.md
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
---
|
||||
id: "bug-1948"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "apiserver"
|
||||
severity: "security"
|
||||
timestamp: "2026-10-10T08:15:06Z"
|
||||
last_seen: "2026-10-10T08:15:06Z"
|
||||
occurrences: 1
|
||||
files: ["src/frontend/apiserver/router/routers.go"]
|
||||
tags: ["apiserver", "security", "whitelist"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1948: apiserver trusts X-Forwarded-For from any client, so IP whitelist and JWT IP binding can be spoofed
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
The router uses `gin.Default()` (`router/routers.go:19`) and never calls `SetTrustedProxies`, so `ClientIP()` honours `X-Forwarded-For` from any peer.
|
||||
|
||||
**Expected:** Forwarded headers are only honoured from configured trusted proxies.
|
||||
**Impact:** Security: a client can claim any IP and bypass the IP whitelist and the IP bound into its JWT.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Send a request with `X-Forwarded-For: <whitelisted IP>` from a non-whitelisted host.
|
||||
2. It passes the whitelist.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
49
.wolf/bugs/bug-1949.md
Normal file
49
.wolf/bugs/bug-1949.md
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
---
|
||||
id: "bug-1949"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "apiserver"
|
||||
severity: "security"
|
||||
timestamp: "2026-10-10T08:15:09Z"
|
||||
last_seen: "2026-10-10T08:15:09Z"
|
||||
occurrences: 1
|
||||
files: ["src/frontend/apiserver/controllers/rbac_check.go", "src/frontend/apiserver/middleware/whitelist.go", "src/frontend/apiserver/controllers/response.go"]
|
||||
tags: ["apiserver", "security", "middleware"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1949: apiserver RequirePermission and IP whitelist write an error but do not abort the request
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
On a bad token `RequirePermission` returns an error response without `Abort()` (`controllers/rbac_check.go:119-122`); the IP whitelist does the same for an invalid client IP (`middleware/whitelist.go:130-132`); `ReturnError` never aborts (`controllers/response.go:30-37`).
|
||||
|
||||
**Expected:** A failed middleware check stops the request before the handler runs.
|
||||
**Impact:** Security: the handler may still run after an authorization failure.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Call a RequirePermission-guarded route with a malformed token claim (see the code path above) and observe the handler running.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
49
.wolf/bugs/bug-1950.md
Normal file
49
.wolf/bugs/bug-1950.md
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
---
|
||||
id: "bug-1950"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "apiserver"
|
||||
severity: "security"
|
||||
timestamp: "2026-10-10T08:15:11Z"
|
||||
last_seen: "2026-10-10T08:15:11Z"
|
||||
occurrences: 1
|
||||
files: ["src/frontend/apiserver/middleware/validatehandler.go"]
|
||||
tags: ["apiserver", "security", "jwt"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1950: apiserver JWT validation does not pin the signing algorithm
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
The middleware's parse callback returns the key without checking `token.Method` (`middleware/validatehandler.go:102-104`), unlike the other parse path (`controllers/auth.go:186`).
|
||||
|
||||
**Expected:** Only the configured HMAC algorithm is accepted.
|
||||
**Impact:** Security hardening: algorithm-confusion class of attacks is not ruled out.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Present a token signed with another algorithm family; validation does not reject it on the algorithm.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
49
.wolf/bugs/bug-1951.md
Normal file
49
.wolf/bugs/bug-1951.md
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
---
|
||||
id: "bug-1951"
|
||||
status: "open"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "newly logged"
|
||||
component: "apiserver"
|
||||
severity: "crash"
|
||||
timestamp: "2026-10-10T08:15:14Z"
|
||||
last_seen: "2026-10-10T08:15:14Z"
|
||||
occurrences: 1
|
||||
files: ["src/frontend/apiserver/backend/auth/config_file.go"]
|
||||
tags: ["apiserver", "auth", "config", "crash"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1951: apiserver crashes on an auth.yaml without a config_file block (nil pointer)
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
`backend/auth/config_file.go:39` reads `cfg.ConfigFile.Users` without checking `cfg.ConfigFile` for nil.
|
||||
|
||||
**Expected:** A missing block is a clear configuration error, not a panic.
|
||||
**Impact:** Crash at startup or login with a minimal auth.yaml.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Start the apiserver with an `auth.yaml` that selects config-file auth but has no `config_file:` block.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
49
.wolf/bugs/bug-1952.md
Normal file
49
.wolf/bugs/bug-1952.md
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
---
|
||||
id: "bug-1952"
|
||||
status: "investigating"
|
||||
status_updated: "2026-10-10"
|
||||
status_note: "suspected from source reading; confirm with a test before fixing"
|
||||
component: "apiserver"
|
||||
severity: "security"
|
||||
timestamp: "2026-10-10T08:15:16Z"
|
||||
last_seen: "2026-10-10T08:15:16Z"
|
||||
occurrences: 1
|
||||
files: ["src/frontend/apiserver/controllers/users.go"]
|
||||
tags: ["apiserver", "security", "rbac"]
|
||||
related: []
|
||||
---
|
||||
|
||||
# bug-1952: apiserver user role changes check a narrower rbac:control grant only against the target user
|
||||
|
||||
## Description
|
||||
**Observed:** (source reading, `.kiro/reviews/project-gap-review-2026-10-10.md` (P0); to be confirmed by a failing test before the fix)
|
||||
Suspected (needs verification): in add/delete roles for a user, a non-`all` `rbac:control` grant is only checked against "is the target me?" (`controllers/users.go:404-412,455-462`), so such a grant could let a user give itself `cluster_admin`. Built-in roles grant `rbac:control` only with domain `all` (`config/rbac.yaml:100-102`), so this is latent.
|
||||
|
||||
**Expected:** A user can never grant itself a role with more rights than it already holds.
|
||||
**Impact:** Security (latent): privilege escalation through a custom role.
|
||||
**Found by:** review: `.kiro/reviews/project-gap-review-2026-10-10.md` (P0)
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (xce.build)
|
||||
- Code: scheduler-framework @ 94472ee3-dirty
|
||||
- Deployment: any (found by source reading; the failing test that confirms it is named in Verification)
|
||||
|
||||
## Reproduction
|
||||
1. Define a role with `rbac:control` scoped to `self`, assign it to a user, then add `cluster_admin` to that same user via the users API.
|
||||
- Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
|
||||
- Evidence: the code sites quoted in Description; no logs kept.
|
||||
## Root cause
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Fix
|
||||
TODO: required for fixed/partial
|
||||
|
||||
## Verification
|
||||
- Test: TODO: name + file; RED before the fix, GREEN after
|
||||
- Suites: TODO: suite results and build profile
|
||||
- Live: TODO: soak/deploy run, or n/a and why
|
||||
|
||||
## References
|
||||
- Related: none
|
||||
Loading…
Add table
Add a link
Reference in a new issue