mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

refuse a namespaced agent whose /nix/store cannot be idmapped

Browse source 
Refs #5888
This commit is contained in:
atlas 2026-11-06 11:04:45 +01:00
commit af739dc8ea
1 changed files with 104 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/vm-tests/agent-ephemeral-rootfs.nix
View file

@ -337,6 +337,10 @@ pkgs.testers.runNixOSTest {
NS_AGENT = "${nsAgent}"
NS_DIR = "${nsDir}"
NS_BINDS = json.loads(${builtins.toJSON (builtins.toJSON nsBinds)})
# nspawn idmaps the /nix/store bind under a user namespace, and hive-priv
# refuses an opted-in agent whose store is on overlayfs; the image under
# it passes both. The remaining steps write nothing to the store.
host.succeed("mount --bind /nix/.ro-store /nix/store")
host.succeed(f"echo before > {NS_DIR}/state/pre.txt && chown 1000:1000 {NS_DIR}/state/pre.txt")
host.succeed(f"stat -c %u:%g {NS_DIR}/state/pre.txt | grep -x 1000:1000")
priv_request(host, {"op": "ensure_agent_socket_dir", "name": NS_AGENT, "private_users": True})
@ -368,10 +372,6 @@ pkgs.testers.runNixOSTest {
host.succeed(f"stat -c %u:%g {NS_DIR}/config/cfg | grep -x 0:0")
host.succeed("stat -c %u:%g ${nsSocketDir} | grep -x ${dataOwner}:${dataOwner}")
# nspawn idmaps the /nix/store bind under a user namespace, which an
# overlayfs store refuses; the image under it accepts it. The remaining
# steps write nothing to the store.
host.succeed("mount --bind /nix/.ro-store /nix/store")
boot_ns = lambda: (
host.succeed(f"nixos-container start {NS}"),
host.wait_until_succeeds(f"nixos-container run {NS} -- systemctl is-active multi-user.target"),