mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-priv: create the nixos-containers directories at boot

Browse source
This commit is contained in:
atlas 2026-11-13 07:37:18 +01:00 • committed by mara
commit bf77b72217
1 changed files with 42 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/4-implementation/trust-boundary/hive-c0re-privilege.md
View file

@ -163,7 +163,10 @@ above for how the hard-coded unit name scopes its access instead.
**Socket-activated** — systemd starts `hive-priv` on the first
incoming connection (`LISTEN_FDS=1`); it's not running between calls.
The `ProtectSystem=strict` + `ReadWritePaths` sandbox limits filesystem
writes to only the paths `hive-priv` legitimately needs. The unit also sets
writes to only the paths `hive-priv` legitimately needs. A `ReadWritePaths`
entry that's missing fails the unit with `226/NAMESPACE`, so tmpfiles rules
create `/etc/nixos-containers`, `/var/lib/nixos-containers` and
`/run/hive-agent` on a hive that has no declared container yet. The unit also sets
`LockPersonality`, `RestrictRealtime`, `ProtectKernelLogs` and
`ProtectKernelModules`: it changes no execution domain, schedules nothing in
real time, reads no kernel log, and loads no module. It sets none of