misc improvements

.github/workflows/consumer-codex-review.yml → .github/workflows/consumer-codeql-actions.yml

@@ -5,42 +5,44 @@
 
 ## Managed by pkg_update_consumer_workflows. Byte-identical
 ## across consumers; this file is `cp`-ed from
-## developer-meta-files/consumer-templates/.github/workflows/consumer-codex-review.yml.
+## developer-meta-files/consumer-templates/.github/workflows/consumer-codeql-actions.yml.
 ## DO NOT hand-edit this file in the consumer repo - changes
 ## will be overwritten on the next propagation pass.
 ##
+## Consumer wrapper for the 'actions' CodeQL language - workflow
+## YAML security analysis (missing-permissions, script-injection,
+## unversioned-immutable-actions, etc.).
+##
+## Cronless on purpose: byte-identical propagation forbids
+## per-repo cron rewrites at propagation time. Push / PR /
+## workflow_dispatch triggers cover the scan-on-change cases;
+## rule-refresh re-scans can be kicked manually from the Actions
+## tab.
+##
 ## Reusable docs:
-## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-codex-review.yml
+## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-codeql.yml
 
-name: OpenAI Codex Review
+name: CodeQL Actions
 
 on:
+  push:
+    branches: [master]
   pull_request:
     branches: [master]
   workflow_dispatch:
-    inputs:
-      pr_ref:
-        description: |
-          Ref of the fork PR to review.
-          Use `refs/pull/<N>/merge` (most accurate; mirrors what
-          would land), or `refs/pull/<N>/head` for the PR head.
-          A plain branch name in the upstream repo also works for
-          non-fork PRs.
-        required: true
-        type: string
 
 permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  review:
-    uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-codex-review.yml@master
+  actions:
+    uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-codeql.yml@master
     with:
-      pr-ref: ${{ inputs.pr_ref || '' }}
+      language: actions
     permissions:
+      security-events: write
       contents: read
-      pull-requests: write

.github/workflows/local-permission-hardener-test.yml

@@ -0,0 +1,59 @@
+---
+## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
+## See the file COPYING for copying conditions.
+
+## AI-Assisted
+
+## Regression test for the permission-hardener config parser.
+##
+## Scope is intentionally narrow: it exercises load_state()'s
+## right-anchored option parsing so a config filename containing a
+## space is parsed as one entry instead of being split and silently
+## dropped. See ci/tests/permission_hardener/test_whitespace_filename.sh.
+
+name: Test permission-hardener
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Test permission-hardener
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    ## CI runs only where we enabled it; ANDed with the existing guard.
+    ## Unset variable -> skipped, no runner, run stays green.
+    if: >-
+      vars.CI_ENABLED_ORG_AI_ASSISTED == 'true'
+      && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request')
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+
+      ## permission-hardener sources helper-scripts (log_run_die.sh,
+      ## safe_echo.sh, strings.bsh) at startup; install-deps provides
+      ## them under /usr/libexec/helper-scripts/.
+      - name: Install genmkfile + helper-scripts + safe-rm
+        uses: org-ai-assisted/developer-meta-files/.github/actions/install-deps@master
+        with:
+          apt-packages: 'safe-rm'
+
+      - name: Whitespace-in-filename parser regression test
+        ## Root: the test writes a temp config under
+        ## /etc/permission-hardener.d/ and runs 'print-policy'.
+        run: sudo -E ci/tests/permission_hardener/test_whitespace_filename.sh

ci/dfuzzer-build.sh

@@ -25,24 +25,39 @@
 ##
 ## dfuzzer is NOT packaged in Ubuntu 24.04 noble (verified via
 ## packages.ubuntu.com - 'No such package'); hence the from-source
-## build. Pinned to upstream tag v2.6 (latest release as of
-## 2026-05-08). Bump when a new release lands.
+## build. Pinned to upstream tag v2.6 AND its exact commit (verified
+## below); latest release as of 2026-05-08. Bump both DFUZZER_TAG and
+## DFUZZER_COMMIT together when a new release lands.
 
 set -o errexit
 set -o nounset
 set -o pipefail
 set -o errtrace
+shopt -s inherit_errexit
+shopt -s shift_verbose
+
+## style-ok: no-tmp-hardcode  (ephemeral CI build clone under /tmp/dfuzzer)
 
 if [ "${CI:-}" != "true" ] && [ "${ALLOW_LOCAL:-}" != "true" ]; then
   printf '%s\n' "${BASH_SOURCE[0]}: refusing to run outside CI. Set ALLOW_LOCAL=true to override." >&2
   exit 1
 fi
 
 DFUZZER_TAG="${DFUZZER_TAG:-v2.6}"
+## Pin the exact upstream commit. A tag is mutable; verifying the
+## resolved commit hash detects a re-pointed tag (supply-chain guard).
+## Keep in sync with DFUZZER_TAG on every version bump.
+DFUZZER_COMMIT="${DFUZZER_COMMIT:-a955a80f7dd20fd7aeffad91da1c495aab5dbbd3}"
 
-## TODO: Better to clone the whole repository, then check out a commit hash?
 git clone --depth 1 --branch "${DFUZZER_TAG}" \
   https://github.com/dbus-fuzzer/dfuzzer /tmp/dfuzzer
+
+dfuzzer_actual_commit="$(git -C /tmp/dfuzzer rev-parse HEAD)"
+if [ "${dfuzzer_actual_commit}" != "${DFUZZER_COMMIT}" ]; then
+  printf '%s\n' "${BASH_SOURCE[0]}: dfuzzer tag ${DFUZZER_TAG} resolved to ${dfuzzer_actual_commit}, expected ${DFUZZER_COMMIT} -- refusing (tag moved?)." >&2
+  exit 1
+fi
+
 meson setup --buildtype=release /tmp/dfuzzer/build /tmp/dfuzzer
 ninja -C /tmp/dfuzzer/build -v
 sudo install -m 0755 /tmp/dfuzzer/build/dfuzzer /usr/local/bin/dfuzzer

ci/tests/permission_hardener/test_state_spaced_filename.sh

@@ -0,0 +1,68 @@
+#!/bin/bash
+## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
+## See the file COPYING for copying conditions.
+
+## AI-Assisted
+
+## Regression test: a hardened file whose path contains spaces must be
+## un-hardenable via 'disable'.
+##
+## load_state_without_policy() reads the dpkg-statoverride state DB, one entry
+## per line as 'owner group mode path'. A plain 4-field split drops any spaced
+## path, so 'disable' never finds the entry and the file can never be restored.
+##
+## Seeds one spaced entry (mode 0744) into the state DB, sets the file to 0600,
+## runs 'disable', and asserts the mode is restored to 0744 -- which only
+## happens if load_state_without_policy read the spaced path back.
+##
+## Requires root: writes the state DB and chmod/chowns the target file.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+set -o errtrace
+shopt -s inherit_errexit
+shopt -s shift_verbose
+
+repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)"
+ph_bin="${PERMISSION_HARDENER_BIN:-${repo_root}/usr/bin/permission-hardener#security-misc-shared}"
+
+if [ ! -f "${ph_bin}" ]; then
+  printf '%s\n' "FAIL: permission-hardener not found at '${ph_bin}'." >&2
+  exit 1
+fi
+
+## Must match store_dir in the script under test.
+existing_mode_admindir='/var/lib/permission-hardener-v2/existing_mode'
+mkdir -p -- "${existing_mode_admindir}"
+
+test_dir="$(mktemp -d -t ph-state-test.XXXXXX)"
+spaced_file="${test_dir}/spaced tool"
+touch -- "${spaced_file}"
+chmod 0600 -- "${spaced_file}"
+
+## invoked indirectly via 'trap ... EXIT'
+# shellcheck disable=SC2317
+cleanup() {
+  ## undo touches the master and new_mode DBs, not existing_mode, so remove the
+  ## seeded entry explicitly.
+  dpkg-statoverride --admindir "${existing_mode_admindir}" --remove \
+    "${spaced_file}" >/dev/null 2>&1 || true
+  safe-rm -rf -- "${test_dir}"
+}
+trap cleanup EXIT
+
+## Seed the state DB: this is the record 'enable' would have written.
+dpkg-statoverride --admindir "${existing_mode_admindir}" --add \
+  root root 0744 "${spaced_file}"
+
+"${ph_bin}" disable "${spaced_file}" >/dev/null 2>&1 || true
+
+actual_mode="$(stat -c '%a' -- "${spaced_file}")"
+if [ "${actual_mode}" = '744' ]; then
+  printf '%s\n' "PASS: spaced-path state entry read back; mode restored to 744."
+  exit 0
+fi
+
+printf '%s\n' "FAIL: mode is '${actual_mode}', expected '744' -- spaced state entry not read back, file cannot be un-hardened." >&2
+exit 1