harden(cloud): strip KUBECONFIG / DOCKER_CONFIG / AWS_CONFIG_FILE for k8s/docker/aws/psql wrappers

[thehoff]

Goal

Zero-trust layer on cloud-CLI wrappers. Each tool here has a config-file-driven exec primitive (kubectl exec credential plugin, docker credsStore, aws credential_process). Env vars that point at those config files are the hijack vectors.

Pattern

Per-tool secure_*_command() since the env-var sets differ. Or one secure_cloud_command(tool) with a per-tool table.

Env vars to strip

kubectl (src/cmds/cloud/container.rs k8s paths):

• KUBECONFIG (kubeconfig can set users[].user.exec → literal RCE)
• KUBE_EDITOR, EDITOR, VISUAL (invoked by kubectl edit)
• KUBECTL_EXTERNAL_DIFF (invoked by kubectl diff)

docker (src/cmds/cloud/container.rs docker paths):

• DOCKER_CONFIG (config.json credsStore=evil)
• DOCKER_CLI_PLUGIN_EXTRA_DIRS (plugin path)
• DOCKER_HOST, DOCKER_CONTEXT (attacker daemon)

aws (src/cmds/cloud/aws_cmd.rs):

• AWS_CONFIG_FILE (can set credential_process = /tmp/evil)
• AWS_SHARED_CREDENTIALS_FILE
• AWS_PLUGIN_PATH

psql (src/cmds/cloud/psql_cmd.rs):

• PSQLRC (\! shell escape in startup script)
• PSQL_HISTORY (overwrite)
• PGSERVICEFILE, PGPASSFILE (info disclosure)

curl/wget (src/cmds/cloud/curl_cmd.rs, wget_cmd.rs):

• CURL_HOME, WGETRC

Args to reject

• kubectl --kubeconfig <env-derived path>
• docker --config <env-derived dir>
• aws --profile <env-derived>, aws --ca-bundle
• kubectl edit, kubectl diff in agent-facing mode (or strip env before invoking)

Tests

tests/security/cloud_hardening.rs with per-tool sections.