From 1277f5d4ca5620f6a14fe38701dc1971c8d2562a Mon Sep 17 00:00:00 2001 From: iris Date: Sat, 15 Aug 2026 12:19:12 +0200 Subject: [PATCH] docs(security): fix stale forge.rs path, GetAgentMeta validator, hive-priv table --- docs/security.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/docs/security.md b/docs/security.md index dda8f4b5..3a142cc0 100644 --- a/docs/security.md +++ b/docs/security.md @@ -134,9 +134,9 @@ dashboard renders anchors only for tokens that passed the same checks the read endpoint enforces. The same invariant holds wherever an agent-supplied name reaches a filesystem -path: the agent socket's `GetAgentMeta` validates `name` with -`validate_agent_name` before building `agent_notes_dir(name)`, so a `..` -component can't traverse. +path: the agent socket's `GetAgentMeta` takes `name` as a serde-validated +`hive_types::Ident` (or falls back to `Ident::parse` for the "self" case) +before building `agent_notes_dir(name)`, so a `..` component can't traverse. ## Nix builds and credential isolation @@ -167,7 +167,7 @@ token policy bounds file reads; network isolation bounds network reach. user ``. nixbld users cannot read it. - `$HYPERHIVE_STATE_DIR/forge-token` (= `/agents//state/forge-token`) — written at mode `0600` and chowned to the per-agent uid:gid (see - `hive-c0re/src/forge.rs`'s module doc for exactly where). nixbld users + `hive-c0re/src/forge/mod.rs`'s module doc for exactly where). nixbld users cannot read it. **Policy**: all credential files written to agent state directories MUST be mode @@ -209,7 +209,8 @@ known operations; there is no arbitrary command pass-through: | Operation | What it runs | | ---------------------------------------------------- | ----------------------------------------------------------------------------------------- | -| `StartContainer` / `StopContainer` / `KillContainer` | `nixos-container start/stop/kill ` | +| `StartContainer` / `StopContainer` | `nixos-container start/stop ` | +| `KillContainer` | `machinectl kill --signal=SIGKILL` (`nixos-container` has no kill verb) | | `CreateContainer` / `UpdateContainer` | `nixos-container create/update --flake ` | | `DestroyContainer` | `nixos-container destroy ` | | `ListContainers` | `nixos-container list` | @@ -226,7 +227,9 @@ known operations; there is no arbitrary command pass-through: **Container allowlist** — every request is validated against an allowlist before any operation: only names matching the agent-name convention (char-validated) or the known sibling service containers -(`hive-gateway`, `hive-forge`, `hive-matrix`, `hive-ci`) are accepted. +(`hive-forge`, `hive-matrix`, `hive-ci`) are accepted. `hive-gateway` is +a host unit, not a container, so it is not in this list — see +`ReloadGatewayNginx` above for how its access is scoped instead. Arbitrary container names are rejected. **Socket-activated** — systemd starts `hive-priv` on the first