vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

swarm-controller: assert socketPath is not in a shared runtime dir

Browse source 
The socket is 0666 (nginx needs to connect(2) as a different user), so its
directory is the only thing bounding what the gateway's nginx can reach —
the crate's README already says so. A unit test pins DEFAULT_SOCKET, but
that only catches a developer editing the const; an operator setting the
documented socketPath option to a shared dir (notably /run/hyperhive,
which holds the host admin socket, or /run/hive) went unenforced.

Denylist rather than the general "not any other module's socket dir"
form — narrower, but it's what the README names and lands without pulling
in other modules' constants.

Refs #4208
This commit is contained in:
atlas 2026-09-16 19:41:04 +02:00
commit 205986f77e
1 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nix/host-modules/swarm-controller.nix
View file

@ -720,6 +720,26 @@ in
state directory.
'';
}
{
assertion =
let
dir = builtins.dirOf deployCfg.swarm-controller.socketPath;
in
dir != "/run/hyperhive" && dir != "/run/hive" && dir != "/run";
message = ''
services.hyperhive.deploy.swarm-controller.socketPath puts the
controller socket in
${builtins.dirOf deployCfg.swarm-controller.socketPath}, a
directory that carries other sockets.
The controller socket is 0666 and the gateway's nginx is given
its directory, so that directory is the access control.
/run/hyperhive holds host.sock — the host ADMIN socket — and
/run/hive holds the per-agent and priv sockets. Give the
controller a directory of its own (the default,
/run/swarm-controller, is one).
'';
}
];
systemd.services.swarm-controller = {