[click0]

TODO-only: no code change, no version bump.

I re-read every remaining MED/LOW claim from the bug hunt against f34fe27. The ones that held are recorded with file:line and a priority. Two did not hold and are left out:

• login.conf being read after jail_attach — this matches jexec -l / login(1), and only rlimits, priority and umask are applied.
• The lenient jid parse in the fw-lease dispatcher — the verb itself is parsed strictly.

§2 crated privops / HTTP — security

• MED: a mount_nullfs source that lies above the tenant root passes sourceForeign. A tenant can bind /var/run into its own jail and reach every other tenant's rootfs. trust-model.md says this was closed in 1.1.17.
• LOW: findOwnerByPath answers from stale rows; byJid / byName don't.
• LOW, hardening: the ipfw add/delete verbs stay host-wide. The fw lease slot could gate them.

§5 Spec parsing

• MED: ${VAR:-default} is not supported. As a result:

  • examples/webapp.yml does not parse;
  • postgres.yml hands pkg a literal package name;
  • three stack files keep the text verbatim.

  CI validates only nginx.yml.

• MED: the .local forbidden-key list can be sidestepped. The parser accepts hyphenated synonyms the list does not check, securelevel sits at the wrong path, a nested duplicate share goes unchecked, and devices / ipc/raw_sockets / zfs/datasets are not listed.

• LOW: devices: merges by shape, not by device class.

• LOW: a hostname with a trailing dot is accepted by the spec but refused by privops.

§7 Lifecycle, storage, GUI

• MED: etc/keep fails on files that already exist in the jail's /etc (hosts, resolv.conf).
• MED: run/user under a root run keeps HOME=/root and puts the X cookie in /root.
• MED: the profile cache is rebuilt by mtime only.
• MED: profile-from-trace treats O_DIRECTORY opens as file reads.
• MED: crate audit false WARNs: nc without -v, and bpf classed as a host device.
• MED: backup/export streams are created 0644 and follow symlinks.
• LOW:
  • replicate can wedge itself (no -F, and it destroys the local snapshot on any error);
  • a signal death loses its signal in the exit code (1 instead of 128+N), and 124 is overloaded;
  • wrap's Exec quoting (latent);
  • LineBuffer's clear (latent);
  • raw non-UTF-8 bytes reach the JSON output.

§11 Build

• LOW: command paths outside lib/pathnames.h, listed one by one.

---

Generated by Claude Code