mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

run opted-in agents in a user namespace with a dedicated data owner

Browse source
This commit is contained in:
atlas 2026-11-01 13:50:53 +01:00 • committed by mara
commit bfdf603d12
1 changed files with 828 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

9
hive-priv/src/files.rs
View file

@ -13,7 +13,7 @@ use hive_priv_sock::{AGENT_STATE_ROOT, PAUSED_MARKER_FILE};
use crate::shared::{StagedFile, ensure_plain_filename, open_dir, validate_agent_name};
/// Root of the per-agent unix-socket dirs on the host.
const SOCKET_DIR_ROOT: &str = "/run/hive-agent";
pub(crate) const SOCKET_DIR_ROOT: &str = "/run/hive-agent";
/// `SetAgentPaused`.
pub(crate) fn exec_set_agent_paused(agent_name: &str, paused: bool) -> Result<(String, String)> {
@ -155,6 +155,13 @@ pub(crate) fn remove_legacy_tmpfiles() -> Result<()> {
/// `EnsureAgentSocketDir` — create `/run/hive-agent/<name>` if missing.
pub(crate) fn ensure_agent_socket_dir(name: &str) -> Result<(String, String)> {
ensure_socket_dir_in(Path::new(SOCKET_DIR_ROOT), name)?;
// A namespaced agent's activation cannot chown the dir through the id
// mapping, so the data owner, which is the agent user inside, gets it here.
if let Some(owner) = crate::userns::owner_for_agent(name)? {
let path = Path::new(SOCKET_DIR_ROOT).join(name);
std::os::unix::fs::lchown(&path, Some(owner), Some(owner))
.with_context(|| format!("chown {}", path.display()))?;
}
Ok((String::new(), String::new()))
}