bastion 0.53.2

client-go/rootexec_test.go

@@ -0,0 +1,757 @@
+//go:build !windows
+
+package main
+
+// Root commands (rootexec.go): the exec frame's round trip, every wall that
+// refuses it, the output cap and the deadline, the transcript and audit rows,
+// and the console ceremony that is the only way a grant comes to exist.
+
+import (
+	"crypto/ed25519"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/gorilla/websocket"
+)
+
+const rootExecTestSecret = "GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ"
+
+// fakeExec is a rootExecProc: it writes what it was told to, then exits with
+// code — or, with block set, waits until it is killed.
+type fakeExec struct {
+	mu      sync.Mutex
+	killed  bool
+	done    chan struct{}
+	code    int
+	started []string
+}
+
+func withFakeExec(t *testing.T, stdout, stderr string, code int, block bool) *fakeExec {
+	t.Helper()
+	fe := &fakeExec{done: make(chan struct{}), code: code}
+	old := rootExecStart
+	rootExecStart = func(command string, so, se io.Writer, cgroupFD int) (rootExecProc, error) {
+		fe.mu.Lock()
+		fe.started = append(fe.started, command)
+		fe.mu.Unlock()
+		_, _ = io.WriteString(so, stdout)
+		_, _ = io.WriteString(se, stderr)
+		if !block {
+			fe.Kill()
+		}
+		return fe, nil
+	}
+	t.Cleanup(func() { rootExecStart = old; fe.Kill() })
+	return fe
+}
+
+func (f *fakeExec) Wait() int { <-f.done; return f.code }
+func (f *fakeExec) Kill() {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if !f.killed {
+		f.killed = true
+		close(f.done)
+	}
+}
+func (f *fakeExec) ran() []string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]string(nil), f.started...)
+}
+
+func withDaemonRoot(t *testing.T, root bool) {
+	t.Helper()
+	old := sessionDaemonIsRoot
+	sessionDaemonIsRoot = func() bool { return root }
+	t.Cleanup(func() { sessionDaemonIsRoot = old })
+}
+
+func rootExecCode(t *testing.T, at time.Time) string {
+	t.Helper()
+	raw, err := b32decode(rootExecTestSecret)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return hotp(raw, at.Unix()/stepupPeriod)
+}
+
+// rootExecBox is an anchored box whose anchor pairing has a factor enrolled,
+// with the daemon reading as root. grant=true gives the standing grant through
+// the console ceremony itself.
+func rootExecBox(t *testing.T, grant bool) sessionEnv {
+	t.Helper()
+	env, _ := rootExecBoxKey(t, grant)
+	return env
+}
+
+func rootExecBoxKey(t *testing.T, grant bool) (sessionEnv, ed25519.PrivateKey) {
+	t.Helper()
+	priv := setupBox(t)
+	env, _, _ := sessionTestEnv(t, nil, nil)
+	env.HostName = tAnchor
+	withDaemonRoot(t, true)
+	if err := stepupSave(env.DcnDir, &stepupFile{SecretB32: rootExecTestSecret,
+		EnrolledAt: "2026-10-11T00:00:00Z", LastCounter: -1}); err != nil {
+		t.Fatal(err)
+	}
+	if grant {
+		now := time.Now()
+		if _, err := rootExecGrantWithCode(env.DcnDir, tAnchor, env.Server, rootExecCode(t, now), 24*time.Hour, now); err != nil {
+			t.Fatalf("grant: %v", err)
+		}
+	}
+	return env, priv
+}
+
+func sendExec(t *testing.T, ws *websocket.Conn, sid, command string, deadline, maxOut int) {
+	t.Helper()
+	sendSpec(t, ws, sessionSpec{Op: sessionOpRootExec, SessionID: sid, Command: command,
+		DeadlineS: deadline, MaxOutputBytes: maxOut})
+}
+
+func execResult(t *testing.T, got map[byte][]byte) rootExecResult {
+	t.Helper()
+	var r rootExecResult
+	if len(got['J']) == 0 {
+		t.Fatalf("no J frame: X=%q E=%q", got['X'], got['E'])
+	}
+	if err := json.Unmarshal(got['J'], &r); err != nil {
+		t.Fatalf("J frame: %v", err)
+	}
+	return r
+}
+
+func auditText(t *testing.T, env sessionEnv) string {
+	t.Helper()
+	raw, _ := os.ReadFile(filepath.Join(env.DcnDir, "audit.jsonl"))
+	return string(raw)
+}
+
+func TestRootExecRoundTrip(t *testing.T) {
+	env := rootExecBox(t, true)
+	fe := withFakeExec(t, "hello out\n", "a warning\n", 3, false)
+	ws := sessionDialAs(t, env, tAnchor)
+	sendExec(t, ws, "exec-0001", "systemctl status x", 30, 0)
+	got := readUntil(t, ws, 'X', 5*time.Second)
+	if string(got['X']) != "3" {
+		t.Fatalf("X must carry the command's own status: X=%q E=%q", got['X'], got['E'])
+	}
+	r := execResult(t, got)
+	if r.Stdout != "hello out\n" || r.Stderr != "a warning\n" || r.Exit != 3 || r.User != "root" ||
+		r.TimedOut || r.StdoutTruncated || r.StderrTruncated || r.DeadlineS != 30 || r.StdoutBytes != 10 {
+		t.Fatalf("result: %+v", r)
+	}
+	if ran := fe.ran(); len(ran) != 1 || ran[0] != "systemctl status x" {
+		t.Fatalf("the command run must be the one sent: %q", ran)
+	}
+	tr, err := os.ReadFile(filepath.Join(env.CtxRoot, "sessions", "exec-0001.log"))
+	if err != nil {
+		t.Fatalf("transcript: %v", err)
+	}
+	for _, want := range []string{"== root command exec-0001 host=" + tAnchor + " user=root", "systemctl status x\n",
+		"hello out\n", "a warning\n", "exit=3 reason=exit"} {
+		if !strings.Contains(string(tr), want) {
+			t.Fatalf("transcript lacks %q:\n%s", want, tr)
+		}
+	}
+	a := auditText(t, env)
+	for _, want := range []string{`"op":"session:root:exec"`, `"event":"start"`, `"command":"systemctl status x"`,
+		`"event":"stop"`, `"exit":3`, `"op":"root_exec_grant"`} {
+		if !strings.Contains(a, want) {
+			t.Fatalf("audit lacks %s:\n%s", want, a)
+		}
+	}
+}
+
+// Every wall refuses with E + X 126, runs nothing, sends no J, leaves no
+// transcript and is audited with the command it refused.
+func TestRootExecRefusals(t *testing.T) {
+	cases := []struct {
+		name  string
+		self  string
+		setup func(t *testing.T, env sessionEnv)
+		want  string
+	}{
+		{"no grant", tAnchor, func(t *testing.T, env sessionEnv) {}, "no standing grant"},
+		{"grant expired", tAnchor, func(t *testing.T, env sessionEnv) {
+			g, _ := rootExecGrantLoad(env.DcnDir)
+			g.Expires = time.Now().Add(-time.Minute).UTC().Format(time.RFC3339)
+			_ = rootExecGrantSave(env.DcnDir, g)
+		}, "expired"},
+		{"grant revoked", tAnchor, func(t *testing.T, env sessionEnv) {
+			if _, err := rootExecRevoke(env.DcnDir, time.Now()); err != nil {
+				t.Fatal(err)
+			}
+		}, "revoked"},
+		{"grant for another host", tAnchor, func(t *testing.T, env sessionEnv) {
+			g, _ := rootExecGrantLoad(env.DcnDir)
+			g.Host = tMember
+			_ = rootExecGrantSave(env.DcnDir, g)
+		}, "is for '" + tMember + "'"},
+		{"grant for another machine", tAnchor, func(t *testing.T, env sessionEnv) {
+			g, _ := rootExecGrantLoad(env.DcnDir)
+			g.Server = "other-box"
+			_ = rootExecGrantSave(env.DcnDir, g)
+		}, "machine 'other-box'"},
+		{"member pairing", tMember, func(t *testing.T, env sessionEnv) {}, "anchor host"},
+		{"daemon not root", tAnchor, func(t *testing.T, env sessionEnv) { withDaemonRoot(t, false) }, "run as root"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			env, priv := rootExecBoxKey(t, c.name != "no grant")
+			if c.self == tMember {
+				// A member the anchor DID give the session family: the caps
+				// wall passes it, so what refuses is the anchor-only wall.
+				writePairingState(t, tMember, pairingPending)
+				grantMemberCaps(t, priv, "session")
+			}
+			c.setup(t, env)
+			fe := withFakeExec(t, "should not run", "", 0, false)
+			ws := sessionDialAs(t, env, c.self)
+			sendExec(t, ws, "exec-refuse", "id", 0, 0)
+			got := readUntil(t, ws, 'X', 5*time.Second)
+			if string(got['X']) != "126" || len(got['J']) != 0 || !strings.Contains(string(got['E']), c.want) {
+				t.Fatalf("want X 126, no J, E ~%q; got X=%q J=%q E=%q", c.want, got['X'], got['J'], got['E'])
+			}
+			if len(fe.ran()) != 0 {
+				t.Fatal("a refused command must never start")
+			}
+			if e := string(got['E']); !strings.HasPrefix(e, "refused") || strings.Contains(e, "refused: refused") {
+				t.Fatalf("the refusal says refused once: %q", e)
+			}
+			if _, err := os.Stat(filepath.Join(env.CtxRoot, "sessions", "exec-refuse.log")); err == nil {
+				t.Fatal("a refused command must not leave a transcript")
+			}
+			if a := auditText(t, env); !strings.Contains(a, `"event":"refused"`) || !strings.Contains(a, `"command":"id"`) {
+				t.Fatalf("refusal not audited with its command:\n%s", a)
+			}
+		})
+	}
+}
+
+// The person's local switch ("session" off on this machine) stops root
+// commands too, grant or not.
+func TestRootExecLocalSwitchRefuses(t *testing.T) {
+	env := rootExecBox(t, true)
+	if err := localDenySet(tAnchor, "session", true); err != nil {
+		t.Fatal(err)
+	}
+	fe := withFakeExec(t, "", "", 0, false)
+	ws := sessionDialAs(t, env, tAnchor)
+	sendExec(t, ws, "exec-switch", "id", 0, 0)
+	got := readUntil(t, ws, 'X', 5*time.Second)
+	if string(got['X']) != "126" || len(fe.ran()) != 0 {
+		t.Fatalf("switched off here must refuse: X=%q E=%q", got['X'], got['E'])
+	}
+}
+
+func TestRootExecOutputCapIsStated(t *testing.T) {
+	env := rootExecBox(t, true)
+	big := strings.Repeat("a", 6000) + strings.Repeat("z", 4240) // 10240 bytes
+	withFakeExec(t, big, "", 0, false)
+	ws := sessionDialAs(t, env, tAnchor)
+	sendExec(t, ws, "exec-cap01", "yes | head", 0, 10) // asks below the floor: held to 1 KiB
+	got := readUntil(t, ws, 'X', 5*time.Second)
+	r := execResult(t, got)
+	if !r.StdoutTruncated || r.StdoutBytes != 10240 || r.MaxOutputBytes != rootExecMinOutput {
+		t.Fatalf("cap: %+v", r)
+	}
+	if !strings.HasPrefix(r.Stdout, strings.Repeat("a", 512)) || !strings.HasSuffix(r.Stdout, strings.Repeat("z", 512)) ||
+		!strings.Contains(r.Stdout, "bytes cut here: 10240 bytes in all") {
+		t.Fatalf("the kept head and tail and the cut must be stated: %q", r.Stdout)
+	}
+	// The local transcript keeps the whole output, not the capped copy.
+	tr, _ := os.ReadFile(filepath.Join(env.CtxRoot, "sessions", "exec-cap01.log"))
+	if !strings.Contains(string(tr), big) {
+		t.Fatal("the transcript must hold the whole output")
+	}
+}
+
+func TestRootExecDeadlineKills(t *testing.T) {
+	env := rootExecBox(t, true)
+	fe := withFakeExec(t, "started\n", "", 0, true)
+	ws := sessionDialAs(t, env, tAnchor)
+	sendExec(t, ws, "exec-dead1", "sleep 999", 1, 0)
+	got := readUntil(t, ws, 'X', 10*time.Second)
+	r := execResult(t, got)
+	if string(got['X']) != "124" || !r.TimedOut || r.Exit != 124 || r.Stdout != "started\n" {
+		t.Fatalf("deadline: X=%q %+v", got['X'], r)
+	}
+	fe.mu.Lock()
+	k := fe.killed
+	fe.mu.Unlock()
+	if !k {
+		t.Fatal("the deadline must kill the command")
+	}
+}
+
+func TestRootExecHostCloseKills(t *testing.T) {
+	env := rootExecBox(t, true)
+	fe := withFakeExec(t, "", "", 0, true)
+	ws := sessionDialAs(t, env, tAnchor)
+	sendExec(t, ws, "exec-close", "sleep 999", 600, 0)
+	deadline := time.Now().Add(3 * time.Second)
+	for len(fe.ran()) == 0 && time.Now().Before(deadline) {
+		time.Sleep(10 * time.Millisecond)
+	}
+	_ = ws.Close()
+	for time.Now().Before(deadline.Add(2 * time.Second)) {
+		fe.mu.Lock()
+		k := fe.killed
+		fe.mu.Unlock()
+		if k {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatal("the host closing the socket must kill the command")
+}
+
+func TestRootExecBadCommandIsExit1(t *testing.T) {
+	env := rootExecBox(t, true)
+	fe := withFakeExec(t, "", "", 0, false)
+	for i, c := range []string{"", "   ", "a\x00b", strings.Repeat("x", rootExecCommandMax+1)} {
+		ws := sessionDialAs(t, env, tAnchor)
+		sendExec(t, ws, fmt.Sprintf("exec-bad-%d", i), c, 0, 0)
+		got := readUntil(t, ws, 'X', 5*time.Second)
+		if string(got['X']) != "1" {
+			t.Fatalf("case %d: want X 1, got %q", i, got['X'])
+		}
+	}
+	if len(fe.ran()) != 0 {
+		t.Fatal("a bad command must never start")
+	}
+}
+
+// The real starter, as whoever runs the suite: both streams, the exit status,
+// and a deadline that ends the whole process group.
+func TestRootExecRealShell(t *testing.T) {
+	var so, se strings.Builder
+	var mu sync.Mutex
+	w := func(b *strings.Builder) io.Writer {
+		return writerFunc(func(p []byte) (int, error) { mu.Lock(); defer mu.Unlock(); return b.Write(p) })
+	}
+	p, err := startRootExec("echo out; echo err >&2; exit 7", w(&so), w(&se), -1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if code := p.Wait(); code != 7 || so.String() != "out\n" || se.String() != "err\n" {
+		t.Fatalf("code=%d out=%q err=%q", code, so.String(), se.String())
+	}
+	admit := fenceRootExecGroups(t)
+	p, err = startRootExec("sleep 30 & sleep 30; echo never", io.Discard, io.Discard, -1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	admit(p.(*shellProc).cmd.Process.Pid)
+	start := time.Now()
+	p.Kill()
+	p.Wait()
+	if time.Since(start) > 10*time.Second {
+		t.Fatal("kill must end the group, background children included, promptly")
+	}
+}
+
+type writerFunc func([]byte) (int, error)
+
+func (f writerFunc) Write(p []byte) (int, error) { return f(p) }
+
+// A grant taken back while a command runs stops that command: the walls are
+// looked at again every rootExecRecheck, and the first one that no longer
+// holds kills the group. The answer is X 126 with a J that says why.
+//
+// MUTATION: drop the recheck case from handleRootExec's run loop.
+// RESULT: red — the command runs on to its deadline and X never arrives.
+func TestRootExecStopsWhenAWallFallsMidRun(t *testing.T) {
+	old := rootExecRecheck
+	rootExecRecheck = 50 * time.Millisecond
+	t.Cleanup(func() { rootExecRecheck = old })
+	cases := []struct {
+		name string
+		fall func(t *testing.T, env sessionEnv)
+		want string
+	}{
+		{"revoked at the console", func(t *testing.T, env sessionEnv) {
+			if _, err := rootExecRevoke(env.DcnDir, time.Now()); err != nil {
+				t.Fatal(err)
+			}
+		}, "revoked"},
+		{"expired", func(t *testing.T, env sessionEnv) {
+			g, _ := rootExecGrantLoad(env.DcnDir)
+			g.Expires = time.Now().Add(-time.Second).UTC().Format(time.RFC3339)
+			if err := rootExecGrantSave(env.DcnDir, g); err != nil {
+				t.Fatal(err)
+			}
+		}, "expired"},
+		{"switched off here", func(t *testing.T, env sessionEnv) {
+			if err := localDenySet(tAnchor, "session", true); err != nil {
+				t.Fatal(err)
+			}
+		}, "session"},
+		{"quarantined", func(t *testing.T, env sessionEnv) {
+			for i := 0; i < quarantineStrikes; i++ {
+				noteRefusal(tAnchor, sessionOpRootExec, "refused: test", true, time.Now())
+			}
+		}, "quarantined"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			env := rootExecBox(t, true)
+			fe := withFakeExec(t, "started\n", "", 0, true)
+			ws := sessionDialAs(t, env, tAnchor)
+			sendExec(t, ws, "exec-fall1", "sleep 999", 600, 0)
+			for i := 0; i < 300 && len(fe.ran()) == 0; i++ {
+				time.Sleep(10 * time.Millisecond)
+			}
+			// While every wall holds, the recheck leaves the command alone.
+			time.Sleep(4 * rootExecRecheck)
+			fe.mu.Lock()
+			early := fe.killed
+			fe.mu.Unlock()
+			if early {
+				t.Fatal("the recheck killed a command whose grant still holds")
+			}
+			fell := time.Now()
+			c.fall(t, env)
+			got := readUntil(t, ws, 'X', 3*time.Second)
+			if took := time.Since(fell); took > rootExecRecheck+time.Second {
+				t.Fatalf("stopped %s after the wall fell; the recheck is every %s", took, rootExecRecheck)
+			}
+			if string(got['X']) != "126" {
+				t.Fatalf("a command stopped by this machine answers X 126: X=%q E=%q", got['X'], got['E'])
+			}
+			var j map[string]any
+			if err := json.Unmarshal(got['J'], &j); err != nil {
+				t.Fatalf("a command that ran answers J: %v (J=%q)", err, got['J'])
+			}
+			if s, _ := j["stopped"].(string); !strings.Contains(s, c.want) {
+				t.Fatalf("J must say why it stopped (~%q): %q", c.want, got['J'])
+			}
+			if j["stdout"] != "started\n" || !strings.Contains(string(got['E']), c.want) {
+				t.Fatalf("J keeps the output and E says why: J=%q E=%q", got['J'], got['E'])
+			}
+			fe.mu.Lock()
+			k := fe.killed
+			fe.mu.Unlock()
+			if !k {
+				t.Fatal("the command must be killed")
+			}
+			if a := auditText(t, env); !strings.Contains(a, `"event":"stop"`) || !strings.Contains(a, `"exit":126`) {
+				t.Fatalf("the stop must be audited with its reason:\n%s", a)
+			}
+		})
+	}
+}
+
+// fenceRootExecGroups routes every group signal the code sends through a
+// fence that admits only the process groups this test started itself. A
+// group is admitted once the test has read it from /proc as its own child
+// leading its own group, never from what the code under test reports, so a
+// Kill that aimed anywhere else (0 is the test's own group, -1 is every
+// process) is refused and fails the test instead of reaching the machine.
+func fenceRootExecGroups(t *testing.T) (admit func(pid int)) {
+	t.Helper()
+	var mu sync.Mutex
+	allowed := map[int]bool{}
+	var refused []int
+	old := rootExecSignalGroup
+	rootExecSignalGroup = func(pgid int, sig syscall.Signal) error {
+		mu.Lock()
+		ok := allowed[pgid]
+		if !ok {
+			refused = append(refused, pgid)
+		}
+		mu.Unlock()
+		if !ok {
+			return syscall.EPERM
+		}
+		return syscall.Kill(-pgid, sig)
+	}
+	t.Cleanup(func() {
+		rootExecSignalGroup = old
+		mu.Lock()
+		defer mu.Unlock()
+		if len(refused) > 0 {
+			t.Errorf("Kill signalled process groups this test did not start: %v", refused)
+		}
+	})
+	return func(pid int) {
+		st, ok := procStat(pid)
+		if !ok || pid <= 1 || st.ppid != os.Getpid() || st.pgrp != pid {
+			t.Fatalf("pid %d is not a group leader this test started: %+v", pid, st)
+		}
+		mu.Lock()
+		allowed[pid] = true
+		mu.Unlock()
+	}
+}
+
+type procStatLine struct {
+	state byte
+	ppid  int
+	pgrp  int
+}
+
+// procStat reads state, parent and process group from /proc/<pid>/stat.
+func procStat(pid int) (procStatLine, bool) {
+	raw, err := os.ReadFile(filepath.Join("/proc", strconv.Itoa(pid), "stat"))
+	if err != nil {
+		return procStatLine{}, false
+	}
+	s := string(raw)
+	i := strings.LastIndexByte(s, ')')
+	if i < 0 {
+		return procStatLine{}, false
+	}
+	f := strings.Fields(s[i+1:])
+	if len(f) < 3 || len(f[0]) != 1 {
+		return procStatLine{}, false
+	}
+	ppid, _ := strconv.Atoi(f[1])
+	pgrp, _ := strconv.Atoi(f[2])
+	return procStatLine{state: f[0][0], ppid: ppid, pgrp: pgrp}, true
+}
+
+// groupLiving lists the processes in group pgid that are still alive: a
+// zombie has ended and is only waiting for its parent to collect it.
+func groupLiving(pgid int) []int {
+	ents, _ := os.ReadDir("/proc")
+	var out []int
+	for _, e := range ents {
+		pid, err := strconv.Atoi(e.Name())
+		if err != nil {
+			continue
+		}
+		if st, ok := procStat(pid); ok && st.pgrp == pgid && st.state != 'Z' && st.state != 'X' {
+			out = append(out, pid)
+		}
+	}
+	return out
+}
+
+// The deadline ends the whole process group, a child that ignores SIGTERM
+// included: SIGKILL follows the grace whether or not the shell has already
+// gone. Run through the handler with the real starter, so the measured time
+// is the one the host sees.
+//
+// MUTATION: skip the SIGKILL when Wait has returned within the grace.
+// RESULT: red — the sleep that traps SIGTERM is still alive after X.
+func TestRootExecDeadlineKillsAChildThatIgnoresSIGTERM(t *testing.T) {
+	if _, err := os.Stat("/proc/self/stat"); err != nil {
+		t.Skip("no /proc here to read the process group from")
+	}
+	for _, c := range []struct{ name, command string }{
+		// the trapping child holds nothing open: Wait returns the moment the shell dies
+		{"output closed", "(trap '' TERM; exec sleep 37) >/dev/null 2>&1 & sleep 37"},
+		// the trapping child holds the output open, as far as WaitDelay
+		{"output held", "(trap '' TERM; exec sleep 37) & sleep 37"},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			env := rootExecBox(t, true)
+			admit := fenceRootExecGroups(t)
+			var mu sync.Mutex
+			pgid := 0
+			old := rootExecStart
+			rootExecStart = func(command string, so, se io.Writer, cgroupFD int) (rootExecProc, error) {
+				p, err := startRootExec(command, so, se, cgroupFD)
+				if err == nil {
+					pid := p.(*shellProc).cmd.Process.Pid
+					admit(pid)
+					mu.Lock()
+					pgid = pid
+					mu.Unlock()
+				}
+				return p, err
+			}
+			t.Cleanup(func() { rootExecStart = old })
+			ws := sessionDialAs(t, env, tAnchor)
+			start := time.Now()
+			sendExec(t, ws, "exec-trap1", c.command, 1, 0)
+			got := readUntil(t, ws, 'X', 15*time.Second)
+			took := time.Since(start)
+			mu.Lock()
+			g := pgid
+			mu.Unlock()
+			if g == 0 {
+				t.Fatalf("the command never started: X=%q E=%q", got['X'], got['E'])
+			}
+			t.Cleanup(func() {
+				for _, pid := range groupLiving(g) {
+					_ = syscall.Kill(pid, syscall.SIGKILL) // only what this test started, read back from /proc
+				}
+			})
+			if string(got['X']) != "124" {
+				t.Fatalf("deadline: X=%q E=%q", got['X'], got['E'])
+			}
+			if lim := time.Second + rootExecKillGrace + 1500*time.Millisecond; took > lim {
+				t.Fatalf("answered after %s; the deadline is 1s and the grace %s", took, rootExecKillGrace)
+			}
+			// SIGKILL has been sent by now; a killed process ends when it next
+			// runs, so it gets a moment, never the trap's 37 seconds.
+			left := groupLiving(g)
+			for end := time.Now().Add(time.Second); len(left) > 0 && time.Now().Before(end); left = groupLiving(g) {
+				time.Sleep(20 * time.Millisecond)
+			}
+			if len(left) > 0 {
+				t.Fatalf("the process group outlived the deadline and the grace: %v still alive", left)
+			}
+		})
+	}
+}
+
+// Every outcome leaves an audit row, the ones that never reach the walls too.
+//
+// MUTATION: remove the rootExecAudit call from the bad-command or the
+// transcript branch of handleRootExec.
+// RESULT: red — that case finds no row.
+func TestRootExecBadCommandAndTranscriptFailureAreAudited(t *testing.T) {
+	env := rootExecBox(t, true)
+	fe := withFakeExec(t, "", "", 0, false)
+	for i, c := range []string{"", "a\x00b", strings.Repeat("x", rootExecCommandMax+1)} {
+		sid := fmt.Sprintf("exec-audbad-%d", i)
+		ws := sessionDialAs(t, env, tAnchor)
+		sendExec(t, ws, sid, c, 0, 0)
+		if got := readUntil(t, ws, 'X', 5*time.Second); string(got['X']) != "1" {
+			t.Fatalf("case %d: want X 1, got %q", i, got['X'])
+		}
+		row := auditRow(t, env, sid)
+		if row == nil {
+			t.Fatalf("case %d: a bad command left no audit row:\n%s", i, auditText(t, env))
+		}
+		if row["exit"] != float64(1) || !strings.Contains(fmt.Sprint(row["decision"]), "bad command") ||
+			row["command_bytes"] != float64(len(c)) || row["command_sha256"] == nil {
+			t.Fatalf("case %d: the row must say bad command, exit 1, its size and its sha256: %v", i, row)
+		}
+	}
+	// A session id the lane will not take, on a root command.
+	ws0 := sessionDialAs(t, env, tAnchor)
+	sendExec(t, ws0, "bad id!", "id", 0, 0)
+	if got := readUntil(t, ws0, 'X', 5*time.Second); string(got['X']) != "1" {
+		t.Fatalf("bad session id: want X 1, got %q", got['X'])
+	}
+	if row := auditRow(t, env, "bad id!"); row == nil || row["command"] != "id" ||
+		!strings.Contains(fmt.Sprint(row["decision"]), "session_id") {
+		t.Fatalf("a root command with a bad session id must leave a row with its command: %v\n%s", row, auditText(t, env))
+	}
+	// A transcript that cannot be opened: one already there under that id.
+	sid := "exec-audtr1"
+	if err := os.MkdirAll(filepath.Join(env.CtxRoot, "sessions"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(env.CtxRoot, "sessions", sid+".log"), []byte("earlier\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	ws := sessionDialAs(t, env, tAnchor)
+	sendExec(t, ws, sid, "id", 0, 0)
+	if got := readUntil(t, ws, 'X', 5*time.Second); string(got['X']) != "1" {
+		t.Fatalf("transcript failure: want X 1, got X=%q E=%q", got['X'], got['E'])
+	}
+	row := auditRow(t, env, sid)
+	if row == nil {
+		t.Fatalf("a transcript that failed to open left no audit row:\n%s", auditText(t, env))
+	}
+	if row["exit"] != float64(1) || !strings.Contains(fmt.Sprint(row["decision"]), "transcript") || row["command"] != "id" {
+		t.Fatalf("the row must say transcript, exit 1 and the command: %v", row)
+	}
+	if len(fe.ran()) != 0 {
+		t.Fatal("neither may start")
+	}
+}
+
+// auditRow is the last root-command row in the audit file for one session id.
+func auditRow(t *testing.T, env sessionEnv, sid string) map[string]any {
+	t.Helper()
+	var last map[string]any
+	for _, line := range strings.Split(auditText(t, env), "\n") {
+		var m map[string]any
+		if json.Unmarshal([]byte(line), &m) == nil && m["session_id"] == sid && m["op"] == sessionOpRootExec {
+			last = m
+		}
+	}
+	return last
+}
+
+// The ceremony: the grant exists only through the code enrolled here, once
+// per code, with an expiry, and a revoke takes it back.
+func TestRootExecGrantCeremony(t *testing.T) {
+	dir := t.TempDir()
+	now := time.Now()
+	if _, err := rootExecGrantWithCode(dir, "h", "box1", "123456", time.Hour, now); err == nil ||
+		!strings.Contains(err.Error(), "second factor") {
+		t.Fatalf("no factor enrolled must refuse: %v", err)
+	}
+	if err := stepupSave(dir, &stepupFile{SecretB32: rootExecTestSecret, EnrolledAt: "2026-10-11T00:00:00Z", LastCounter: -1}); err != nil {
+		t.Fatal(err)
+	}
+	code := rootExecCode(t, now)
+	if _, err := rootExecGrantWithCode(dir, "h", "box1", code, 0, now); err == nil {
+		t.Fatal("a grant with no expiry must be refused")
+	}
+	if _, err := rootExecGrantWithCode(dir, "h", "box1", code, 400*24*time.Hour, now); err == nil {
+		t.Fatal("a grant past the longest term must be refused")
+	}
+	wrong := "000000"
+	if wrong == code {
+		wrong = "111111"
+	}
+	if _, err := rootExecGrantWithCode(dir, "h", "box1", wrong, time.Hour, now); err == nil {
+		t.Fatal("a wrong code must not grant")
+	}
+	if _, err := os.Stat(rootExecGrantPath(dir)); err == nil {
+		t.Fatal("no grant may exist before a code checked out")
+	}
+	g, err := rootExecGrantWithCode(dir, "h", "box1", code, 30*24*time.Hour, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if why := rootExecGrantCheck(dir, "h", "box1", now); why != "" {
+		t.Fatalf("a fresh grant must admit: %s", why)
+	}
+	if why := rootExecGrantCheck(dir, "h", "box1", now.Add(31*24*time.Hour)); !strings.Contains(why, "expired") {
+		t.Fatalf("past its expiry the grant must refuse: %q", why)
+	}
+	if _, err := rootExecGrantWithCode(dir, "h", "box1", code, time.Hour, now); err == nil {
+		t.Fatal("REPLAY: the same code must not grant twice")
+	}
+	if g.Expires != now.Add(30*24*time.Hour).UTC().Format(time.RFC3339) {
+		t.Fatalf("expiry: %s", g.Expires)
+	}
+	if _, err := rootExecRevoke(dir, now); err != nil {
+		t.Fatal(err)
+	}
+	if why := rootExecGrantCheck(dir, "h", "box1", now); !strings.Contains(why, "revoked") {
+		t.Fatalf("a revoked grant must refuse: %q", why)
+	}
+	for in, want := range map[string]time.Duration{"30d": 30 * 24 * time.Hour, "12h": 12 * time.Hour, "90m": 90 * time.Minute} {
+		if d, err := parseGrantFor(in); err != nil || d != want {
+			t.Fatalf("parseGrantFor(%q) = %v, %v", in, d, err)
+		}
+	}
+	for _, bad := range []string{"", "0d", "-1d", "forever", "-5h"} {
+		if _, err := parseGrantFor(bad); err == nil {
+			t.Fatalf("parseGrantFor(%q) must fail", bad)
+		}
+	}
+}
+
+// The op is advertised with the other session ops, so a grant can name it
+// and a deny can refuse it.
+func TestRootExecOpAdvertised(t *testing.T) {
+	found := false
+	for _, o := range sessionOps {
+		found = found || o == sessionOpRootExec
+	}
+	if !found || opFamily(sessionOpRootExec) != "session" {
+		t.Fatalf("sessionOps=%v family=%q", sessionOps, opFamily(sessionOpRootExec))
+	}
+}