vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

add the agent option privateUsers, with the uid = gid assertion

Browse source
This commit is contained in:
atlas 2026-11-01 16:05:36 +01:00 • committed by mara
commit 1fd591d28b
1 changed files with 76 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

37
nix/module-eval/agent-user.nix
View file

@ -27,7 +27,44 @@ let
.system.activationScripts.hive-agent-user-migrate.text;
# The tmpfiles rules of the same named agent.
rules = (agentWith { services.hyperhive.agent.user.name = "iris"; }).systemd.tmpfiles.rules;
# `privateUsers` with the given pins; the agent name is the one the cases
# above use, so only the pins differ.
withUsers =
user:
agentWith {
services.hyperhive.agent.user = {
name = "iris";
}
// user;
};
# Whether the module refuses the config over the user-namespace pin.
refusesPins =
cfg: lib.any (a: !a.assertion && lib.hasInfix "privateUsers" a.message) cfg.assertions;
cases = [
{
# The control is the matching pair: it passes, so each refusal is the
# assertion's own and the default (off, no pins) passes too.
name = "privateUsers needs a uid and a gid that are the same number";
ok =
!refusesPins (withUsers { })
&& !refusesPins (withUsers {
privateUsers = true;
uid = 1000;
gid = 1000;
})
&& refusesPins (withUsers {
privateUsers = true;
})
&& refusesPins (withUsers {
privateUsers = true;
uid = 1000;
})
&& refusesPins (withUsers {
privateUsers = true;
uid = 1000;
gid = 1001;
});
}
{
# hive-c0re creates the host work dir as hive-core; this activation is
# the only thing that lets the agent write to it.