Skip to content

docs: state the real-host evidence where the threat model denied it #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
isaacslee merged 1 commit into from
Oct 16, 2026
Merged

docs: state the real-host evidence where the threat model denied it #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions docs/decisions/0002-baseline-restricts-namespaces.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,5 +26,6 @@ a restriction it did not have.
- **Jobs that fail on `baseline`:** any job that creates namespaces. That
covers rootless containers, `unshare`, `bwrap` and some test harnesses. They
need `userns`, chosen per profile.
- **Not yet verified:** that the GitHub runner itself works under
`RestrictNamespaces=yes`. This is checked on the test VM before Alpha.
- **Verified on the ARM64 test VM:** the GitHub runner registers and runs
jobs under `RestrictNamespaces=yes`, and `unshare -U` is refused inside
them ([verification.md](../verification.md), assumption 1).
10 changes: 7 additions & 3 deletions docs/threat-model.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,13 @@ one Linux host that also does other work. This document says:
- which mechanism each protection rests on;
- how `runner-slice check` proves that mechanism on the running host.

Every claim here is SYNTHETICALLY TESTED unless it says otherwise. Nothing in
this document has yet been observed on a real host running this code. The
evidence levels are defined in [verification.md](verification.md).
Every claim here is SYNTHETICALLY TESTED by the drills. The boundary was also
observed on one real host, an Ubuntu 24.04 aarch64 VM with systemd 255 and two
real GitHub runners, at RUNTIME VERIFIED and REBOOT VERIFIED. It was observed
both by `check` and from inside real jobs
([acceptance/2026-10-arm64.md](acceptance/2026-10-arm64.md)). On any other
host, these claims are unverified. The evidence levels are defined in
[verification.md](verification.md).

## Who is trusted

Expand Down