Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- When an app action runs in its child process, the child shall hold no worker secret in its environment or initial environ block.
- If app code reads /proc/self/environ, /proc/<pid>/environ or /run/highway/secrets/**, then the read shall fail.
STATUS: hypothesis from static reading during #994 (NOT reproduced live). enterprise/apps/executor.py starts multiprocessing.Process(target=run_worker) which inherits os.environ (DB_PASSWORD, HIGHWAY_ENCRYPTION_KEY, RBAC_MASTER_ENCRYPTION_KEY, SECRET_*); enterprise/apps/code_loader_security.py ALLOWED_IMPORTS includes pathlib, io and tempfile, so pathlib.Path('/proc/self/environ').read_bytes() looks reachable from app code. os.environ.clear() in the child would NOT help: /proc/self/environ shows the exec-time block. Same uid also reaches the platform secret files mounted at /run/highway/secrets/platform. Reproduce with a throwaway app version through the apps API (tenant test) printing only variable NAMES before fixing. Related: #994, #991.

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #1006