From edbe3faeb02d488c8f2934237d099437bddf748b Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Fri, 23 Oct 2026 22:37:51 +1100
Subject: [PATCH] Skip exact hosts covered by a .domain in nginx maps; confine
 router with SELinux

---
 agent-sandbox | 9 ++++++---
 tests/test.sh | 8 ++++++++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/agent-sandbox b/agent-sandbox
index be8210f..00d1149 100755
--- a/agent-sandbox
+++ b/agent-sandbox
@@ -85,8 +85,12 @@ router_config() {
     done
   } >"$dir/dnsmasq.conf"
 
+  # nginx "hostnames" rejects an exact key that a .domain key already covers.
   local map=""
-  for host in $hosts; do map+="    $host 1;"$'\n'; done
+  for host in $hosts; do
+    [[ $host != .* && " ${hosts//$'\n'/ } " == *" .$host "* ]] && continue
+    map+="    $host 1;"$'\n'
+  done
   cat >"$dir/nginx.conf" <<EOF
 load_module /usr/lib/nginx/modules/ngx_stream_module.so;
 worker_processes 1;
@@ -172,8 +176,7 @@ main() {
 
   podman run -d --rm --name "$router" \
     --network "$session:ip=$rip" --network "$EGRESS_NET" \
-    --security-opt label=disable \
-    -v "$tmp:/etc/router:ro" \
+    -v "$tmp:/etc/router:ro,Z" \
     "$ROUTER_IMAGE" >/dev/null
   wait_port "$router" "$rip" 443
 
diff --git a/tests/test.sh b/tests/test.sh
index a7cd413..c203474 100755
--- a/tests/test.sh
+++ b/tests/test.sh
@@ -54,6 +54,14 @@ check tcp-servers "$(printf '%s\n' \
   "$(grep 'set \$up' <<<"$nginx")"
 check listens-on-router-only "" "$(grep -E 'listen ' <<<"$nginx" | grep -v 'listen 10\.89\.7\.2:')"
 
+f=$(list '.example.org' 'example.org' 'example.org:22' 'a.example.org' 'example.org')
+dir=$(mktemp -d)
+router_config "$f" "$dir" 10.89.7.2 >/dev/null
+check overlap-dnsmasq "$(printf '%s\n' 'address=/example.org/127.0.0.2' 'host-record=a.example.org,127.1.0.1' \
+  'host-record=example.org,127.1.0.2')" "$(grep -E '^(address=/e|host-record)' "$dir/dnsmasq.conf")"
+check overlap-map "$(printf '    %s 1;\n' .example.org a.example.org .example.org a.example.org)" \
+  "$(grep '^    .* 1;$' "$dir/nginx.conf")"
+
 for bad in 'exa mple.com' 'example.com:0' 'example.com:70000' 'example.com:ssh' '*.example.com' \
   '-bad.com' 'http://example.com' 'a..b' '.example.com:22'; do
   (allowlist_entries "$(list "$bad")") >/dev/null 2>&1