From 3d8fa0200e113e4a61f16702fb91e5435a6a0858 Mon Sep 17 00:00:00 2001 From: ogt Date: Wed, 15 Jul 2026 02:15:44 +0800 Subject: [PATCH] fix(security): remove credentialed reboot SOP command --- docs/runbooks/REBOOT-RECOVERY-SOP.md | 3 ++- .../tests/test_reboot_p0_operational_contract.py | 7 +++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/runbooks/REBOOT-RECOVERY-SOP.md b/docs/runbooks/REBOOT-RECOVERY-SOP.md index e80956cc1..a5e3da73a 100644 --- a/docs/runbooks/REBOOT-RECOVERY-SOP.md +++ b/docs/runbooks/REBOOT-RECOVERY-SOP.md @@ -479,7 +479,8 @@ curl -s --max-time 5 http://192.168.0.121:32334/api/v1/health 2>/dev/null | pyth ```bash # 自動化腳本通常已處理，但若沒有自動啟動: ssh ollama@192.168.0.188 "sudo /usr/local/bin/awoooi-startup.sh" -ssh wooo@192.168.0.110 "echo '0936223270' | sudo -S /usr/local/bin/awoooi-startup-110.sh" +ssh wooo@192.168.0.110 "sudo -n /usr/local/bin/awoooi-startup-110.sh" +# 若 sudo -n 不可用，改走 Agent99 allowlisted executor 或本機 console；禁止把密碼寫入 SOP、命令列或 evidence。 ``` **P1 (T+5~15 分鐘): K3s 叢集** diff --git a/scripts/reboot-recovery/tests/test_reboot_p0_operational_contract.py b/scripts/reboot-recovery/tests/test_reboot_p0_operational_contract.py index f4612c7e5..644f4c4f1 100644 --- a/scripts/reboot-recovery/tests/test_reboot_p0_operational_contract.py +++ b/scripts/reboot-recovery/tests/test_reboot_p0_operational_contract.py @@ -15,6 +15,13 @@ def read(path: str) -> str: return (ROOT / path).read_text(encoding="utf-8") +def test_reboot_sop_never_embeds_passworded_sudo_startup() -> None: + sop = read("docs/runbooks/REBOOT-RECOVERY-SOP.md") + + assert "sudo -n /usr/local/bin/awoooi-startup-110.sh" in sop + assert "| sudo -S /usr/local/bin/awoooi-startup-110.sh" not in sop + + def load_public_maintenance_probe() -> ModuleType: path = ROOT / "scripts/reboot-recovery/public-maintenance-fallback-probe.py" spec = importlib.util.spec_from_file_location(