vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(security): fix stale forge.rs path, GetAgentMeta validator, hive-priv table

Browse source
This commit is contained in:
iris 2026-08-15 12:19:12 +02:00 • committed by mara
commit 1277f5d4ca
1 changed files with 9 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/security.md
View file

@ -134,9 +134,9 @@ dashboard renders anchors only for tokens that passed the same checks the
read endpoint enforces.
The same invariant holds wherever an agent-supplied name reaches a filesystem
path: the agent socket's `GetAgentMeta` validates `name` with
`validate_agent_name` before building `agent_notes_dir(name)`, so a `..`
component can't traverse.
path: the agent socket's `GetAgentMeta` takes `name` as a serde-validated
`hive_types::Ident` (or falls back to `Ident::parse` for the "self" case)
before building `agent_notes_dir(name)`, so a `..` component can't traverse.
## Nix builds and credential isolation
@ -167,7 +167,7 @@ token policy bounds file reads; network isolation bounds network reach.
user `<name>`. nixbld users cannot read it.
- `$HYPERHIVE_STATE_DIR/forge-token` (= `/agents/<name>/state/forge-token`)
— written at mode `0600` and chowned to the per-agent uid:gid (see
`hive-c0re/src/forge.rs`'s module doc for exactly where). nixbld users
`hive-c0re/src/forge/mod.rs`'s module doc for exactly where). nixbld users
cannot read it.
**Policy**: all credential files written to agent state directories MUST be mode
@ -209,7 +209,8 @@ known operations; there is no arbitrary command pass-through:
| Operation | What it runs |
| ---------------------------------------------------- | ----------------------------------------------------------------------------------------- |
| `StartContainer` / `StopContainer` / `KillContainer` | `nixos-container start/stop/kill <name>` |
| `StartContainer` / `StopContainer` | `nixos-container start/stop <name>` |
| `KillContainer` | `machinectl kill <machine> --signal=SIGKILL` (`nixos-container` has no kill verb) |
| `CreateContainer` / `UpdateContainer` | `nixos-container create/update <name> --flake <ref>` |
| `DestroyContainer` | `nixos-container destroy <name>` |
| `ListContainers` | `nixos-container list` |
@ -226,7 +227,9 @@ known operations; there is no arbitrary command pass-through:
**Container allowlist** — every request is validated against an
allowlist before any operation: only names matching the agent-name
convention (char-validated) or the known sibling service containers
(`hive-gateway`, `hive-forge`, `hive-matrix`, `hive-ci`) are accepted.
(`hive-forge`, `hive-matrix`, `hive-ci`) are accepted. `hive-gateway` is
a host unit, not a container, so it is not in this list — see
`ReloadGatewayNginx` above for how its access is scoped instead.
Arbitrary container names are rejected.
**Socket-activated** — systemd starts `hive-priv` on the first