Stop exempting undeclared init capabilities and mounts from realization verification

[Brad-Edwards]

Finding

APTL generic systemd substrates add CAP_SYS_ADMIN, CAP_SYS_NICE, CAP_SYS_RESOURCE, and a /sys/fs/cgroup bind mount. Runtime excess detection subtracts those values through hard-coded baseline sets before comparing the realized container with the authored runtime contract.

The TechVault SDL currently has no realization designation and therefore supplies no authored open boundary for those additions. The subtraction means a closed scenario can pass even though the realized node has undeclared privilege and filesystem exposure.

Impact

Security-relevant state becomes invisible to the closed-world comparison. Whether the state is necessary deployment machinery, measurement apparatus, or part of the system under test is decided implicitly in APTL code rather than through the portable author/apparatus boundary and realization evidence.

Required investigation before solutioning

Before proposing changes, investigate and document existing architectural and design patterns in:

• generic init substrate construction and container launch;
• Linux capability and mount realization/readback;
• appliance-boundary and apparatus contracts;
• ADR-047, ADR-048, ADR-051, and the security rationale for the current baseline;
• RAES SEM-218 designation, realization envelope, and observation-strength contracts; and
• how reference and libvirt backends distinguish apparatus-required privilege from scenario-visible privilege.

Do not assume that the current state belongs in the SDL, that it is harmless apparatus, or that removing it is operationally valid until the boundary investigation is complete.

Acceptance criteria

• The repository records whether each added capability and mount belongs to the system under test, backend deployment machinery, or measurement apparatus, with supporting evidence.
• No undeclared security-relevant state is silently removed from closed-world comparison by an ungoverned hard-coded exception.
• Any state outside scenario authorship is admitted through an applicable portable apparatus/backend contract and disclosed in realization evidence.
• A closed scenario rejects additional capabilities and mounts that are not authorized by that contract.
• Scoped-open scenarios accept only additions within the declared capability/envelope.
• Required init behavior continues to be tested as an operational outcome, independently of semantic authorization.
• Regression tests distinguish declared state, authorized apparatus state, and unauthorized excess state.

Relationships

Part of the broader closed/open enforcement defect tracked in #916./ TechVault boundary ownership is tracked in OpenRAE/env-packs#288.