2 Commits

Author	SHA1	Message	Date
jenkins	6e9e8c6ab5	hermes: reject regex literals in polkit grants ... A regex literal embedding a quote desynced the string tokenizer and swallowed an unconditional Result.YES, so the grant read as unscoped and slipped past the literal-identity check. Fail closed on any slash outside a string or comment; neither regex nor division belongs in an identity-scoped grant. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-17 20:37:30 -03:00
jenkins	b8f2163af0	hermes: prove sudo and polkit denial closed ... Expand sudoers User_Alias chains so aliases, wildcards, netgroups, and undefined names cannot smuggle authority to the Hermes account, and require polkit grants to scope through exact literal identity comparisons: computed strings, bracket lookups, subject aliasing, operator-built values, and unconditional or wildcard grants fail closed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-17 15:15:47 -03:00