6739bb903d
Every docs directory moves under 1-getting-started, 2-handbook, 4-implementation or 5-project; the options reference (section 3) comes from the website and has no directory here. trust-boundary stays whole under the handbook for now. web-ui, swarm and tools split between handbook and implementation, and the command-line references move to 2-handbook/reference. Links, path references in code and nix, and the docs index follow the moves; no page content changes.
21 lines
961 B
Markdown
21 lines
961 B
Markdown
# hive-priv-sock
|
|
|
|
Wire types for the **`hive-priv` privileged-helper socket**
|
|
(`/run/hive/priv.sock`) — the contract between `hive-priv` (the root helper,
|
|
server) and `hive-c0re` (client, via its `priv_client`).
|
|
|
|
## Why it's its own crate
|
|
|
|
Split out of `hive-sh4re` so `hive-priv` — a **root-privileged** binary —
|
|
depends on just this narrow protocol crate instead of the much larger
|
|
daemon-shared crate. Two wins: fewer dependencies in a root process's supply
|
|
chain, and a small, self-contained interface makes the privilege boundary this
|
|
crate encodes easier to audit. Mirrors `hive-host-sock`'s split for the host
|
|
admin socket.
|
|
|
|
## Shape
|
|
|
|
Serde-derived request/response types only — no server or client logic. Both
|
|
sides import them so the shapes stay in sync. See `docs/2-handbook/trust-boundary/boundary.md` +
|
|
`docs/2-handbook/trust-boundary/security.md` for the privilege boundary these types sit on, and
|
|
`hive-priv/README` for the helper itself.
|