vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#2391): drop "." entirely from credential/snapshot name charset

Browse source 
Per mara: "i would have even disallowed ., we are making up the rules
here lets go strict". validate_credential_name now restricts to
[A-Za-z0-9_-] (no dot at all) instead of [A-Za-z0-9_.-] + a separate
".." substring check — simpler rule, and there's no legitimate need
for a dot in either a systemd credential id or a hive- prefixed
snapshot label. Matching hivectl client-side check + wire-proto doc
comments updated.
This commit is contained in:
atlas 2026-07-14 18:46:54 +02:00 • committed by mara
commit 2c079afd65
3 changed files with 25 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

5
hive-sh4re/src/priv_proto.rs
View file

@ -199,7 +199,7 @@ pub struct BindMount {
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CredentialMount {
/// systemd credential id (e.g. `otel-headers`); inner units inherit
/// it by this name. Restricted to `[A-Za-z0-9_.-]` by hive-priv.
/// it by this name. Restricted to `[A-Za-z0-9_-]` (no `.`) by hive-priv.
pub name: String,
/// Host path to the secret file, forwarded via nspawn
/// `--load-credential=<name>:<host_path>`.
@ -599,7 +599,8 @@ pub enum PrivRequest {
/// an allow-list hive-priv enforces so only hivectl-issued names
/// can reach the `btrfs subvolume snapshot` shellout — and
/// otherwise follows the same charset as a credential name
/// (non-empty `[A-Za-z0-9_.-]`); becomes part of the snapshot path.
/// (non-empty `[A-Za-z0-9_-]`, no `.`); becomes part of the
/// snapshot path.
snapshot_name: String,
},