Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: efc8acb8b5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c68c34b8e1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b293275360
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4e3920ee33
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8d4f731b61
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Add a private disposable conformance harness for exact sparse and bounded-range rootless Podman identity mappings. Exercise identity transitions, capability drop, namespace isolation, persistent ownership, and Docker pre-mutation rejection across three fresh iterations per profile. Record host and source evidence, and require exact resource cleanup plus full Podman inventory restoration. Update the security-contract acceptance ledger with mechanism evidence while leaving public schema and product runtime integration deferred.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a159fd7092
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ) | ||
| require_pass("unfiltered seccomp control", seccomp_control) | ||
|
|
||
| authority = assert_host_authority(runner, uid_maps, gid_maps) |
There was a problem hiding this comment.
On a host where the selected mapping aliases an NSS principal or another delegation, both containers have already started and executed application probes before this validation runs, so the harness detects the collision only after exercising the authority that the contract requires it to reject before workload start. Fresh evidence is that the newly added synthetic collision cases are also invoked only through this post-start call; preflight the planned host mappings before either podman run.
Useful? React with 👍 / 👎.
| no_cap_name = f"reploy-mi-{token}-{profile}-{iteration}-nocap" | ||
| no_cap_args = common_run_args( | ||
| no_cap_name, seccomp_path, profile, 2, capabilities=False | ||
| ) |
There was a problem hiding this comment.
When a collision falls in the host range selected for the no-capability or unconfined-control container but not either primary workload, the harness executes that container and can still pass because assert_host_authority receives only the two primary containers' maps. This affects both exact slots 2/3 and bounded auto allocations; capture and validate every auxiliary mapping before using it so these security controls cannot run under aliased host authority.
Useful? React with 👍 / 👎.
Add a private disposable conformance harness for exact sparse and bounded-range rootless Podman identity mappings.
Exercise identity transitions, capability drop, namespace isolation, persistent ownership, and Docker pre-mutation rejection across three fresh iterations per profile. Record host and source evidence, and require exact resource cleanup plus full Podman inventory restoration.
Update the security-contract acceptance ledger with mechanism evidence while leaving public schema and product runtime integration deferred.