vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(hivectl): ask the daemon whether an agent exists

Browse source 
The agents root is 0700 and owned by the daemon's user, so hivectl's
client-side existence guard hit EACCES on traversal for anyone not root.
It reported that as "this command needs root; re-run with sudo", which
turned three verbs' pre-flight check into a permission error about the
wrong thing: `choom`, `subvol upgrade` and `subvol snapshot create` all
failed at the guard rather than at whatever they actually needed.

The daemon runs as the owning user and already answers this question for
its own provisioning paths, so expose it on the host socket as
`AgentExists` and have hivectl ask. Operators reach that socket through
the `hive-admin` group, so the guard now works without sudo.

`choom` still needs root for `machinectl shell` — we ship no polkit rule
granting those actions — so it now checks the effective uid and says so
directly instead of failing later inside systemd's authorisation.
This commit is contained in:
atlas 2026-07-26 20:57:49 +02:00 • committed by mara
commit 170fd817ea
9 changed files with 119 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

11
hivectl/src/main.rs
View file

@ -6,9 +6,12 @@
//! restart|…>`, `approvals <pending|approve|deny>`, `stop` / `start`) and
//! provisioning (`forge` / `matrix` / `github` / `gateway`) all forward to
//! the daemon, which owns the broker, the credentials, and the provisioning
//! logic — a running daemon is required for those. A few verbs work off
//! local host state directly instead (`wg` / `peer-config` read the mesh key
//! + TLS CA; `choom` execs into a container), so they don't need the socket.
//! logic — a running daemon is required for those. A couple of verbs work
//! off local host state directly instead (`wg` / `peer-config` read the mesh
//! key + TLS CA), so they don't need the socket. `choom` execs into a
//! container rather than asking the daemon to do anything, but still uses the
//! socket for its "is this an agent?" pre-flight — that answer lives in a
//! directory only the daemon's user can read.
//!
//! One module per subcommand family (see the `mod` list below); `main` is
//! just the clap parse + the top-level dispatch match.
@ -123,7 +126,7 @@ async fn main() -> Result<()> {
Cmd::Choom {
name,
resume_session,
} => choom(&name, resume_session.as_deref()),
} => choom(&socket, &name, resume_session.as_deref()).await,
Cmd::MarkdownDocs => {
print!("{}", clap_markdown::help_markdown::<Cli>());
Ok(())