From 5139fd0674c91f340d014621c962dd05a9da740c Mon Sep 17 00:00:00 2001 From: "Calvin S." Date: Thu, 22 Oct 2026 23:26:20 -0700 Subject: [PATCH 1/3] docs(ci-syslog-watcher): document risk-acceptance for unvalidated rsyslog config copy ci-syslog-watcher.sh copies /var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.conf into /etc/rsyslog.d and restarts rsyslog without validating its content. This is intentional, not an oversight: - The trust boundary for this script is the /var/run/mdsd-ci directory itself, which is populated by the privileged Container Insights (mdsd/AMA) add-on via a hostPath mount - a component deployed and access-controlled entirely outside this repo. AgentBaker has no visibility into, or control over, who can write to that directory. - Anything capable of writing into /var/run/mdsd-ci already has node-level privilege equivalent to what content validation here could additionally restrict, so adding it would not meaningfully reduce risk - it would only create a false sense of security. - The real control point is the add-on's own hostPath/RBAC configuration, which is out of scope for this repo. No functional change - in-place comment only. Verified: bash -n and shellcheck both pass with no warnings. No existing ShellSpec coverage for this script to regress. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 350c2577-7031-4d0d-adc1-e99d053fc981 --- parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh b/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh index 14f35a7b9d2..6f0511a3bd3 100644 --- a/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh +++ b/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh @@ -8,6 +8,15 @@ status=$(cat /var/run/mdsd-ci/update.status) if [ "$status" = "add" ]; then echo "Status changed to $status." + # By design: the rsyslog config dropped here is not content-validated before being + # copied into /etc/rsyslog.d and loaded via `systemctl restart rsyslog` below. The + # trust boundary for this script is the /var/run/mdsd-ci directory itself, which is + # populated by the privileged Container Insights (mdsd/AMA) add-on via a hostPath + # mount - a component deployed and access-controlled outside this repo. Anything + # capable of writing into that directory already has node-level privilege equivalent + # to what this script could additionally restrict, so adding content validation here + # would not meaningfully reduce risk; the real control point is that add-on's + # hostPath/RBAC configuration, not this script. [ -f "/var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.conf" ] && cp /var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.conf /etc/rsyslog.d elif [ "$status" = "remove" ]; then echo "Status changed to $status." From 143fc03b49310b226b49303edc988de9a30708e0 Mon Sep 17 00:00:00 2001 From: "Calvin S." Date: Wed, 28 Oct 2026 20:50:28 -0700 Subject: [PATCH 2/3] docs(ci-syslog-watcher): clarify risk-acceptance wording per review Copilot's review on PR #9882 correctly pointed out that the risk-acceptance comment overclaimed: write access to the /var/run/mdsd-ci hostPath does not inherently guarantee node-level privilege for every possible writer - a workload could in principle be scoped to write only that one path. Reworded to state this as a deployment assumption that is confirmed by the add-on owner, rather than an inherent property of directory access. No functional change - comment wording only. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 350c2577-7031-4d0d-adc1-e99d053fc981 --- .../linux/cloud-init/artifacts/ci-syslog-watcher.sh | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh b/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh index 6f0511a3bd3..14a1439c64c 100644 --- a/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh +++ b/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh @@ -12,11 +12,13 @@ if [ "$status" = "add" ]; then # copied into /etc/rsyslog.d and loaded via `systemctl restart rsyslog` below. The # trust boundary for this script is the /var/run/mdsd-ci directory itself, which is # populated by the privileged Container Insights (mdsd/AMA) add-on via a hostPath - # mount - a component deployed and access-controlled outside this repo. Anything - # capable of writing into that directory already has node-level privilege equivalent - # to what this script could additionally restrict, so adding content validation here - # would not meaningfully reduce risk; the real control point is that add-on's - # hostPath/RBAC configuration, not this script. + # mount - a component deployed and access-controlled outside this repo. This relies + # on a deployment assumption - confirmed by the add-on owner - that every writer + # granted access to this hostPath already has node-level privilege equivalent to what + # this script could additionally restrict; it is not an inherent property of directory + # access, since a workload could in principle be scoped to write only this path. Given + # that assumption, adding content validation here would not meaningfully reduce risk; + # the real control point is that add-on's hostPath/RBAC configuration, not this script. [ -f "/var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.conf" ] && cp /var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.conf /etc/rsyslog.d elif [ "$status" = "remove" ]; then echo "Status changed to $status." From 47e7ea8d08b832bb688f437ef82c4b5ecd853787 Mon Sep 17 00:00:00 2001 From: "Calvin S." Date: Thu, 29 Oct 2026 10:34:04 -0700 Subject: [PATCH 3/3] docs(ci-syslog-watcher): clarify config writer trust requirement Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bb31c5eb-70b8-418b-93cc-3c2bc38e0951 --- .../cloud-init/artifacts/ci-syslog-watcher.sh | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh b/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh index 14a1439c64c..27ac6e494b3 100644 --- a/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh +++ b/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh @@ -8,17 +8,10 @@ status=$(cat /var/run/mdsd-ci/update.status) if [ "$status" = "add" ]; then echo "Status changed to $status." - # By design: the rsyslog config dropped here is not content-validated before being - # copied into /etc/rsyslog.d and loaded via `systemctl restart rsyslog` below. The - # trust boundary for this script is the /var/run/mdsd-ci directory itself, which is - # populated by the privileged Container Insights (mdsd/AMA) add-on via a hostPath - # mount - a component deployed and access-controlled outside this repo. This relies - # on a deployment assumption - confirmed by the add-on owner - that every writer - # granted access to this hostPath already has node-level privilege equivalent to what - # this script could additionally restrict; it is not an inherent property of directory - # access, since a workload could in principle be scoped to write only this path. Given - # that assumption, adding content validation here would not meaningfully reduce risk; - # the real control point is that add-on's hostPath/RBAC configuration, not this script. + # The Container Insights add-on supplies this config outside AgentBaker. + # Copying it trusts /var/run/mdsd-ci writers to configure host rsyslog. + # Deployment owners must restrict writers to components trusted for that role; + # hostPath write access alone does not imply equivalent node-level privilege. [ -f "/var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.conf" ] && cp /var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.conf /etc/rsyslog.d elif [ "$status" = "remove" ]; then echo "Status changed to $status."