f94cc08680
The per-job MIT-MAGIC-COOKIE-1 that unlocks an -X job's X11 forwarding port rode every job reply that asked for it: any job:view caller could read another user's cookie and connect straight to the worker's forwarding port (6100-6199), bypassing the xattach relay's ownership check. The SSE job stream carried it too, since its events embed the full JobInfo row. - apiserver: stripX11Cookie drops the cookie from GetJobsInfo, GetJobByIDs and the SSE stream for every job the caller does not own and holds no job:control grant over — the same rule XAttachJob enforces. The row itself stays visible; only the secret goes. - xcecli: preflightX11 checks DISPLAY, the Xauthority file and the xauth binary before the job is submitted, so a misconfigured display fails in one second instead of dispatching a job nobody can watch. Verified end-to-end on t1: owner reads the cookie, a group mate with job:view(self_ug)+job:control(self) gets the row with the cookie stripped, an unrelated user is refused at the row level; controllers tests cover the matrix plus the SSE path. Co-Authored-By: Claude Code <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| autoscaler | ||
| configs | ||
| controller | ||
| docs | ||
| frontend | ||
| harness | ||
| include | ||
| lib | ||
| nixSupport | ||
| scheduler | ||
| schema | ||
| testsuite_support | ||
| tools | ||
| worker | ||
| xceadmin | ||
| flake.lock | ||
| flake.nix | ||
| meson.build | ||
| meson.options | ||