vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

add one shared templated hive policy keyed on the cert alias name

Browse source
This commit is contained in:
atlas 2026-10-26 08:57:24 +01:00 • committed by mara
commit 03796f1964
4 changed files with 232 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

16
nix/module-eval/bao-grants.nix
View file

@ -1591,6 +1591,22 @@ let
# that the walk reads nothing.
&& pathsUnder "sys/policies/acl/" == [ "path \"sys/policies/acl/hive-*\" {" ];
}
{
# `read_policy.rs` writes the policy every hive's role attaches as
# `hive-hives` and the one every agent's role attaches as `hive-agent`. Both
# sit under the policy glob the controller already holds, so neither
# adds a grant.
name = "the controller's policy-write glob covers the shared hive and agent policies and not a name outside hive-*";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
globs = map (l: lib.removeSuffix "\" {" (lib.removePrefix "path \"" l)) (
lib.filter (l: lib.hasPrefix "path \"sys/policies/acl/" l) (map lib.trim (lib.splitString "\n" s))
);
covers = name: lib.any (g: lib.hasPrefix (lib.removeSuffix "*" g) "sys/policies/acl/${name}") globs;
in
covers "hive-hives" && covers "hive-agent" && !(covers "swarm-hives");
}
{
# `matrix_account::hive_sender` writes every hive's sender token and
# `forge::hive_token` every hive's forge token, and nothing else under