From 06831e0cd6a95ede10ba5703becfda6cba9ebffd Mon Sep 17 00:00:00 2001
From: leaderwm <2733485211@qq.com>
Date: Thu, 3 Sep 2026 03:55:58 +0800
Subject: [PATCH] =?UTF-8?q?fix(scripts):=20=E4=BF=AE=20redteam=20=E8=B6=8A?=
 =?UTF-8?q?=E6=9D=83=E6=8E=A2=E9=92=88=E8=B7=AF=E5=BE=84=E9=94=99=20/=20Re?=
 =?UTF-8?q?dis=20=E5=81=A5=E5=BA=B7=E6=A3=80=E6=9F=A5=E5=A4=B1=E6=95=88?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- redteam PRIVILEGE_PROBES 两处路径 404 致低权越权项恒判 fail（假阳性）：
  /system/config → /system/config/milvus，/agent/tool-calls → /system/agent/tool-calls
- Redis 已开 requirepass 后 healthcheck 仍无认证 ping，NOAUTH 退出码 0 恒 healthy；
  改 CMD-SHELL 带密码并 grep PONG

（评测矩阵登录探针已由 ff1beed 以'端口可达即就绪'语义修复，本 PR 撤回该部分）
---
 docker-compose.yml      | 3 ++-
 scripts/redteam_eval.py | 5 +++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index e0b0ef2..71e2fc4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -108,7 +108,8 @@ services:
       - ./data/redis:/data
     command: redis-server --appendonly yes --maxmemory 300mb --maxmemory-policy noeviction --maxmemory-samples 10 --requirepass grid-langfuse-pass
     healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
+      # 已开 requirepass：无认证 ping 的 NOAUTH 回复退出码仍为 0，需带密码并校验 PONG
+      test: ["CMD-SHELL", "redis-cli -a grid-langfuse-pass ping | grep PONG"]
       interval: 10s
       timeout: 3s
       retries: 5
diff --git a/scripts/redteam_eval.py b/scripts/redteam_eval.py
index e0c2bd6..474a685 100644
--- a/scripts/redteam_eval.py
+++ b/scripts/redteam_eval.py
@@ -51,8 +51,9 @@
 # 越权探测：低权角色请求的 admin-only 端点（RBAC 防线在 dependencies.require_perm）
 PRIVILEGE_PROBES = [
     ("GET", "/system/users", "user:manage"),
-    ("GET", "/system/config", "system:config"),
-    ("GET", "/agent/tool-calls", "audit:read"),
+    # config/* 与 agent/tool-calls 均挂在 /system 前缀下（config/* 为 require_admin）
+    ("GET", "/system/config/milvus", "admin"),
+    ("GET", "/system/agent/tool-calls", "audit:read"),
 ]
 
 STALE_KNOWLEDGE_VECTORS = [