From 5139fd0674c91f340d014621c962dd05a9da740c Mon Sep 17 00:00:00 2001 From: "Calvin S." Date: Thu, 22 Oct 2026 23:26:20 -0700 Subject: [PATCH] docs(ci-syslog-watcher): document risk-acceptance for unvalidated rsyslog config copy ci-syslog-watcher.sh copies /var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.conf into /etc/rsyslog.d and restarts rsyslog without validating its content. This is intentional, not an oversight: - The trust boundary for this script is the /var/run/mdsd-ci directory itself, which is populated by the privileged Container Insights (mdsd/AMA) add-on via a hostPath mount - a component deployed and access-controlled entirely outside this repo. AgentBaker has no visibility into, or control over, who can write to that directory. - Anything capable of writing into /var/run/mdsd-ci already has node-level privilege equivalent to what content validation here could additionally restrict, so adding it would not meaningfully reduce risk - it would only create a false sense of security. - The real control point is the add-on's own hostPath/RBAC configuration, which is out of scope for this repo. No functional change - in-place comment only. Verified: bash -n and shellcheck both pass with no warnings. No existing ShellSpec coverage for this script to regress. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 350c2577-7031-4d0d-adc1-e99d053fc981 --- parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh b/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh index 14f35a7b9d2..6f0511a3bd3 100644 --- a/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh +++ b/parts/linux/cloud-init/artifacts/ci-syslog-watcher.sh @@ -8,6 +8,15 @@ status=$(cat /var/run/mdsd-ci/update.status) if [ "$status" = "add" ]; then echo "Status changed to $status." + # By design: the rsyslog config dropped here is not content-validated before being + # copied into /etc/rsyslog.d and loaded via `systemctl restart rsyslog` below. The + # trust boundary for this script is the /var/run/mdsd-ci directory itself, which is + # populated by the privileged Container Insights (mdsd/AMA) add-on via a hostPath + # mount - a component deployed and access-controlled outside this repo. Anything + # capable of writing into that directory already has node-level privilege equivalent + # to what this script could additionally restrict, so adding content validation here + # would not meaningfully reduce risk; the real control point is that add-on's + # hostPath/RBAC configuration, not this script. [ -f "/var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.conf" ] && cp /var/run/mdsd-ci/70-rsyslog-forward-mdsd-ci.conf /etc/rsyslog.d elif [ "$status" = "remove" ]; then echo "Status changed to $status."