0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5.5 284b0873dd fix(sys-ctl-hlth-runtime): harden LAM CLI, catch apk options, drop vars comment

Addresses three CodeRabbit findings on PR #1265.

1. LAM hardening invisible to the probe (thread 4413764929): the runtime
   check probes PHP with `php -r`, the CLI SAPI. web-app-lam mounted the
   hardening ini only into /etc/php/8.4/apache2/conf.d, which the Debian
   CLI does not scan, so the probe read unhardened CLI settings and the
   check failed for LAM. The php_hardening entry now also mounts the ini
   into /etc/php/8.4/cli/conf.d. No other role mounts it into a Debian
   per-SAPI directory; the rest use the shared scan dir of the official
   image or of Alpine. The TODO entry now names the remaining gap: the
   probe reads only the CLI copy.

2. Explanatory comment above HEALTH_RUNTIME_FLOORS (thread 4413764949):
   removed. The README already states the end-of-life rule and now also
   defines a floor as the lowest patched release of each line.

3. `apk --no-cache add` missed (thread 4415018662): PACKAGE_INSTALL_PATTERN
   required `add` right after `apk`, so `RUN apk --no-cache add php7`
   passed as an image without PHP. The apk branch now accepts options
   before `add`, like the apt branch. New tests cover the option form and
   guard that `apk` in a path or a comment is no package install.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-30 08:57:21 +01:00

552 B

Raw Permalink Blame History

To-dos

Extend HEALTH_RUNTIME_FLOORS, the container probe and make security-runtimes to node, python, ruby and java.
Verify the web SAPI where an image splits it from the CLI. web-app-lam mounts the hardening ini into both /etc/php/8.4/apache2/conf.d and /etc/php/8.4/cli/conf.d, and the probe reads only the CLI copy, so a wrong Apache target would still pass.
Run make security-runtimes in a scheduled CI workflow.
Scan the pinned images for CVEs (Trivy or Grype) in the scheduled CI and report new criticals as issues.

552 B Raw Permalink Blame History

To-dos

552 B

Raw Permalink Blame History