30a8f71bb5
boundary.md keeps the model, the design rule, why network isolation matters and host admin socket access; the hive-priv socket activation and the per-agent socket directory move to 4-implementation/trust-boundary. security.md keeps the agent trust model and the path-name rule; the nix builds mode with its threat model, and the hive-c0re privilege separation, move to their own pages there. Headings and text move as they were, with one level shaved off the heading depth. Links, code and nix pointers, and the docs index follow the moves.
21 lines
978 B
Markdown
21 lines
978 B
Markdown
# hive-priv-sock
|
|
|
|
Wire types for the **`hive-priv` privileged-helper socket**
|
|
(`/run/hive/priv.sock`) — the contract between `hive-priv` (the root helper,
|
|
server) and `hive-c0re` (client, via its `priv_client`).
|
|
|
|
## Why it's its own crate
|
|
|
|
Split out of `hive-sh4re` so `hive-priv` — a **root-privileged** binary —
|
|
depends on just this narrow protocol crate instead of the much larger
|
|
daemon-shared crate. Two wins: fewer dependencies in a root process's supply
|
|
chain, and a small, self-contained interface makes the privilege boundary this
|
|
crate encodes easier to audit. Mirrors `hive-host-sock`'s split for the host
|
|
admin socket.
|
|
|
|
## Shape
|
|
|
|
Serde-derived request/response types only — no server or client logic. Both
|
|
sides import them so the shapes stay in sync. See `docs/2-handbook/trust-boundary/boundary.md` +
|
|
`docs/4-implementation/trust-boundary/hive-c0re-privilege.md` for the privilege boundary these types sit on, and
|
|
`hive-priv/README` for the helper itself.
|