mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-priv: write a configured stable exe path into unit drop-ins

Browse source 
HIVE_PRIV_EXE, set by the module to the /run/hive-rootfs-check link, is
checked at start and used for the drop-in's ExecStartPre. Without it the
running binary's path is used as before, and an unlinked one gets an
error that names the cause.
This commit is contained in:
atlas 2026-11-15 16:34:25 +01:00 • committed by mara
commit ca51bb9d54
2 changed files with 172 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

5
nix/host-modules/hive-priv.nix
View file

@ -137,6 +137,11 @@ in
# The owner a namespaced agent's data moves to. Which agents are
# namespaced is not set here: hive-c0re sends it with each start.
HIVE_PRIV_USERNS_DATA_OWNER = toString userns.dataOwner;
# The binary an agent's drop-in `ExecStartPre=` runs. The tmpfiles link
# above points at the current package and never goes away, so a garbage
# collection or a switch that leaves this process running cannot leave a
# drop-in naming a binary that is gone.
HIVE_PRIV_EXE = rootfsCheck.hivePriv;
};
serviceConfig = {
ExecStart = "${controllerCfg.package}/bin/hive-priv";

4
nix/module-eval/core-toggle.nix
View file

@ -253,13 +253,15 @@ let
{
# Read back from the rendered unit and assertion list: a misspelt
# variable or a dropped assertion fails here.
name = "hive-priv carries the userns data owner, no agent list, and the owner assertion passes";
name = "hive-priv carries the userns data owner, no agent list, the stable exe link its tmpfiles rule creates, and the owner assertion passes";
ok =
let
e = allLocal.systemd.services.hive-priv.environment;
in
!(e ? HIVE_PRIV_USERNS_AGENTS)
&& e.HIVE_PRIV_USERNS_DATA_OWNER == "60000"
&& e.HIVE_PRIV_EXE == "/run/hive-rootfs-check"
&& lib.any (r: lib.hasPrefix "L+ /run/hive-rootfs-check " r) allLocal.systemd.tmpfiles.rules
&& lib.any (
a: lib.hasInfix "hive-controller.userns.dataOwner" a.message && a.assertion
) allLocal.assertions;