Harden program-cache permissions, binary-path resolution, and coredump helper lifetime#2399

Open

rparolin wants to merge 15 commits into

NVIDIA:mainfrom

rparolin:hardening/cache-perms-loader-coredump

Commits on Jul 21, 2026

Harden program-cache perms, binary-path resolution, and coredump helper lifetime

rparolin
and
claude
committed
Simplify code comments on the hardening fixes

rparolin
and
claude
committed
Remove agent_authored markers from the new tests

rparolin
and
claude
committed
Remove weak coredump buffer-lifetime test

rparolin
and
claude
committed
Silence bandit S103 on the intentionally world-writable test dir

rparolin
and
claude
committed
test: expect absolutized binary path on Windows

rparolin
and
claude
committed
Raise on out-of-range c_int/c_byte kernel arguments instead of truncating

rparolin
and
claude
committed
param_packer: use PyLong_AsInt for c_int range check on Python 3.13+

rparolin
and
claude
committed
param_packer: unify c_int/c_byte range check via PyLong_AsLongAndOverflow

rparolin
and
claude
committed
Split kernel-arg overflow change (#363) into its own PR (#2402)

rparolin
and
claude
committed