Feature: /etc/dashcaddy/operator.env (root-owned KEY=VALUE file) is
forwarded into the DashCaddy container as docker -e flags by start.sh.
Canonical flag: ALLOW_LIFETIME_LICENSE=true on the CREATOR host only.
This is a client-side rail, NOT the security boundary: lifetime codes
must HMAC-verify against the creator-only signing secret, which is never
shipped to customers (installs carry only .license-secret-hash; the
license server never issues lifetime codes). Flipping the flag on a
customer host grants nothing. Missing file = normal case (zero flags).
Design (per r3 judge blockers):
1. scripts/operator-flags.js — Node, ONE file descriptor: opened with
O_RDONLY|O_NOFOLLOW, fstat'ed, and read from that SAME fd. Contract:
regular file; no group/other access bits (mode & 077 == 0); no
setuid/setgid/sticky; owner uid 0 under root runtime (euid => owner
equality otherwise). Symlink refused at open even when the target
would pass all checks. No stat-path/reopen-path TOCTOU window.
Violation => stderr FATAL + exit 3. Content is pure data: never
sourced/evaled/executed; `$(...)` values stay inert text.
2. start.sh: rc 3 => warn + forward NOTHING (fail closed); ANY other
non-zero rc => ABORT startup (fail loud, tested policy); missing
file => silent zero overrides. Single helper invocation; keys-only
audit line at boot (never values).
3. Artifact hygiene: verifier asserts zero full-format license codes in
any submission file. (An earlier round leaked one; that code is dead
— signing secret rotated, keygen verify reports INVALID.)
Root-cause hardening (2026-10-08 incident: deploy checkouts overwriting
git-TRACKED runtime state revoked the owner's premium and hid service
cards):
- untrack dashcaddy-api/data/services.json (stale committed copy had
clobbered the live 16-service state incl SamiMail/SamiPanel/Revenue)
- untrack dashcaddy-api/.license-secret + .license-counter, extend
.gitignore. The secret value in prior git history is already rotated,
hence cryptographically dead.
Tests: 16 executed operator-flags tests (O_NOFOLLOW symlink-to-valid-
target, 0644/0755/setuid/directory/foreign-owner rejections,
missing-file-silent, usage error, injection-inert, translation suite);
license-manager 76 + tier-enforcement 21 untouched => 113 targeted green.
Hermes
8ff51fb3ea