Make audit output readable and review Chromium sandbox setuid #6

Merged

mathieu merged 1 commit from fix/issue-5-human-output-setuid into main

2026-08-29 12:25:31 +00:00

hephaistos commented

2026-08-29 03:52:22 +00:00

Owner

Fixes #5

Summary

render audit results as a structured human-readable report with an explicit action;
show both the model assessment and medium-risk findings before asking for confirmation;
keep interactive terminals compact while preserving the complete v1 machine result whenever stdout is redirected, through --json, and in saved reports;
classify only the exact single-target brave-bin command chmod 4755 "$pkgdir/opt/brave-bin/chrome-sandbox" as medium review instead of an automatic high-risk block;
keep all unknown setuid/setgid and file-capability operations at high risk.

The Brave exception does not let the LLM lower deterministic risk. It is a narrow static classification from high to medium and therefore still requires explicit human approval.

Verification

PYTHONPATH=src python3 -W error -m unittest discover -s tests -v — 35 tests pass
bash -n aur/PKGBUILD packaging/PKGBUILD.template — passes
python3 -m compileall -q src tests — passes
git diff --check — passes
rendered a Brave-like fixture: aggregate risk is medium, decision is review, and the interactive machine line is compact

Risk controls

a second or additional setuid target remains high risk;
the exception requires package base brave-bin and the exact /opt/brave-bin/chrome-sandbox target;
chmod 2755, chmod u+s, chmod a+s, chmod -- 4755, leading-zero modes, privileged install -m... forms, and setcap remain high risk;
medium risk caused only by the model still explains the model summary before prompting;
redirected output retains the full v1 machine-result payload;
terminal control characters, including newlines from untrusted model text, are escaped.

Fixes #5 ## Summary - render audit results as a structured human-readable report with an explicit action; - show both the model assessment and medium-risk findings before asking for confirmation; - keep interactive terminals compact while preserving the complete v1 machine result whenever stdout is redirected, through `--json`, and in saved reports; - classify only the exact single-target `brave-bin` command `chmod 4755 "$pkgdir/opt/brave-bin/chrome-sandbox"` as medium review instead of an automatic high-risk block; - keep all unknown setuid/setgid and file-capability operations at high risk. The Brave exception does **not** let the LLM lower deterministic risk. It is a narrow static classification from high to medium and therefore still requires explicit human approval. ## Verification - `PYTHONPATH=src python3 -W error -m unittest discover -s tests -v` — 35 tests pass - `bash -n aur/PKGBUILD packaging/PKGBUILD.template` — passes - `python3 -m compileall -q src tests` — passes - `git diff --check` — passes - rendered a Brave-like fixture: aggregate risk is `medium`, decision is review, and the interactive machine line is compact ## Risk controls - a second or additional setuid target remains high risk; - the exception requires package base `brave-bin` and the exact `/opt/brave-bin/chrome-sandbox` target; - `chmod 2755`, `chmod u+s`, `chmod a+s`, `chmod -- 4755`, leading-zero modes, privileged `install -m...` forms, and `setcap` remain high risk; - medium risk caused only by the model still explains the model summary before prompting; - redirected output retains the full v1 machine-result payload; - terminal control characters, including newlines from untrusted model text, are escaped.

Rows
Columns