vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-bao: let the controller list linked-account dirs

Browse source 
OpenBao checks a LIST against the directory with a trailing slash, so
the controller's LIST on secret/metadata/swarm/agents/<a>/matrix is
checked as .../matrix/. Its empty last segment matches the `+` in the
delete stanza .../agents/+/matrix/+ (added by bbf93120), which then is
the only non-exact rule matching, and its ["delete"] denies the LIST
before acl.go's trimmed-path fallback reaches .../+/matrix ["list"].
The forge directory fails the same way against .../+/forge/+.

Writing the list stanzas as .../+/matrix/ and .../+/forge/ makes them
match the slashed request too, and with one `+` segment against two
they outrank the delete stanzas. Deletes on .../matrix/<id> still
resolve to .../+/matrix/+, which the slashed list path does not match.

Reproduced by iris against a local bao server -dev with a non-root
token: list stanza alone allowed, plus the delete stanza denied, list
stanza with trailing slash plus the delete stanza allowed.

Closes #4919
This commit is contained in:
atlas 2026-10-04 16:58:51 +02:00 • committed by mara
commit 4356dc82a4
2 changed files with 13 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

9
nix/host-modules/swarm-bao.nix
View file

@ -375,6 +375,11 @@ let
#
# The agent PKI grant is its only path on that mount: it can ask the one role
# for a certificate, not write that role or reach the issuer.
# The two `list` paths end in `/`: bao checks a LIST against the directory
# with a trailing slash, where `+` matches the empty last segment, so a
# slashless list path loses that request to the `+/matrix/+` and `+/forge/+`
# delete stanzas and the LIST is denied.
controllerPolicyText = ''
path "auth/cert/certs/hive-*" {
capabilities = ["create", "update", "read", "delete"]
@ -400,11 +405,11 @@ let
capabilities = ["delete"]
}
path "${credentialMountPath}/metadata/swarm/agents/+/matrix" {
path "${credentialMountPath}/metadata/swarm/agents/+/matrix/" {
capabilities = ["list"]
}
path "${credentialMountPath}/metadata/swarm/agents/+/forge" {
path "${credentialMountPath}/metadata/swarm/agents/+/forge/" {
capabilities = ["list"]
}