scripte/nexarch
1
0 Fork 0
Code Issues 1 Pull Requests 21 Actions 7 Packages Projects Releases Wiki Activity

RET-15: echter-ende-zu-ende-nachweis-storage-object-lock-chattr-faehiger-host #324

Closed
patrick wants to merge 3 commits from feature/ret-15-echter-ende-zu-ende-nachweis-storage-object-lock-chattr-faehiger-host into docs/ret-11-nachtrag-chattr-untersuchung
pull from: feature/ret-15-echter-ende-zu-ende-nachweis-storage-object-lock-chattr-faehiger-host
merge into: scripte:docs/ret-11-nachtrag-chattr-untersuchung
Conversation 1 Commits 3 Files Changed 1
+97
3 Commits
Author SHA1 Message Date
patrickandClaude Sonnet 5 da8bd30791 Merge: Basis-Branch (PR #312) einarbeiten, Konflikt in RET-11-NACHTRAG-CHATTR-UNTERSUCHUNG.md aufgeloest
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (pull_request) Canceled after 0s
Details
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (pull_request) Canceled after 0s
Details
Core-Schnittstellen-Vertragstests / contract-tests (pull_request) Canceled after 0s
Details
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
Details
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
Details
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (push) Canceled after 0s
Details
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
Details
CI / Web (dms-browser) (push) Canceled after 0s
Details
CI / Web (pdf-viewer) (push) Canceled after 0s
Details
CI / Web (shl) (push) Canceled after 0s
Details
Archive-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
Details
CI / Core-Modul (Build/Vet/Test) (pull_request) Canceled after 0s
Details
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (pull_request) Canceled after 0s
Details
CI / Web (dms-browser) (pull_request) Canceled after 0s
Details
CI / Web (pdf-viewer) (pull_request) Canceled after 0s
Details
CI / Web (shl) (pull_request) Canceled after 0s
Details
Supply-Chain-Scan (Go) / govulncheck (pull_request) Canceled after 0s
Details
Supply-Chain-Scan (npm) / npm-audit (pull_request) Canceled after 0s
Details
Core-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
Details
RBAC-Rollenhierarchie-Pflichtgate / rbac-policy-invariant (pull_request) Canceled after 0s
Details
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
Details
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (pull_request) Canceled after 0s
Details
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
Details
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (pull_request) Canceled after 0s
Details 
PR #324 (RET-15) war nicht mergefaehig gegen seine Basis (PR #312,
docs/ret-11-nachtrag-chattr-untersuchung): Add/Add-Konflikt in
derselben Datei. Beide Seiten identisch bis auf den von RET-15 neu
angehaengten "RET-15 Nachtrag"-Abschnitt -- Original plus Anhang
behalten, keine inhaltliche Aenderung.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-10-17 01:04:28 +02:00
patrickandClaude Sonnet 5 215fe15e16 RET-15: echter-ende-zu-ende-nachweis-storage-object-lock-chattr-faehiger-host
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
Details
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (pull_request) Canceled after 0s
Details
Archive-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
Details
CI / Core-Modul (Build/Vet/Test) (pull_request) Canceled after 0s
Details
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
Details
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
Details
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (push) Canceled after 0s
Details
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
Details
CI / Web (dms-browser) (push) Canceled after 0s
Details
CI / Web (pdf-viewer) (push) Canceled after 0s
Details
CI / Web (shl) (push) Canceled after 0s
Details
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (pull_request) Canceled after 0s
Details
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (pull_request) Canceled after 0s
Details
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (pull_request) Canceled after 0s
Details
CI / Web (dms-browser) (pull_request) Canceled after 0s
Details
CI / Web (pdf-viewer) (pull_request) Canceled after 0s
Details
CI / Web (shl) (pull_request) Canceled after 0s
Details
Core-Schnittstellen-Vertragstests / contract-tests (pull_request) Canceled after 0s
Details
Supply-Chain-Scan (Go) / govulncheck (pull_request) Canceled after 0s
Details
Supply-Chain-Scan (npm) / npm-audit (pull_request) Canceled after 0s
Details
Core-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
Details
RBAC-Rollenhierarchie-Pflichtgate / rbac-policy-invariant (pull_request) Canceled after 0s
Details
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
Details
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (pull_request) Canceled after 0s
Details 
Suche nach einem chattr-faehigen Host im Projektkontext (131, 204
bereits bekannt unprivilegiert; zusaetzlich Host 236 geprueft) ergibt:
kein privilegierter Host verfuegbar. Host 236 ist ebenfalls ein
unprivilegierter LXC-Container (uid_map 0->100000, ZFS-Root), realer
chattr +i-Testversuch auf synthetischer Testdatei schlaegt mit EPERM
fehl, identisch zu 204/131. AC1/AC2 aus RET-15 bleiben damit offen,
dokumentiert als zweiter Nachtrag-Abschnitt in der bestehenden
RET-11-NACHTRAG-CHATTR-UNTERSUCHUNG.md (kein neues Paralleldokument).
Keine Aenderung an wormstore.go.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-10-16 19:00:30 +00:00
patrickandClaude Sonnet 5 07a4b904c4 archive-kanban: RET-11 Nachtrag - chattr +i EPERM ist Infrastrukturgrenze, kein Code-Bug 
Reale Reproduktion auf Host 204 (chattr, roher FS_IOC_SETFLAGS-Ioctl,
Gegenprobe auf tmpfs im selben Container) zeigt: Ursache ist der
unprivilegierte LXC-Container (capable(CAP_LINUX_IMMUTABLE) prueft
immer gegen den Host-Namespace, nicht gegen den Container), nicht ZFS
wie bisher in RET-11-PRUEFPROTOKOLL.md vermutet - betrifft jedes
Dateisystem im Container. Acht geprueften Alternativen (ZFS readonly/
hold, ACL/chmod, Proxmox-Features, Capabilities, verschachtelte
User-Namespaces, FUSE, externes Object-Lock-Backend) sind im
Container-Scope entweder nicht verfuegbar oder strukturell keine
vollwertige Entsprechung. Keine Aenderung an wormstore.go, da der
bestehende Fail-Closed-Mechanismus (ImmutableLockSupported) bereits
korrekt reagiert.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-10-16 18:58:54 +00:00