vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

add one shared templated agent policy and name each agent's bao entity after it

Browse source
This commit is contained in:
atlas 2026-10-25 20:39:59 +01:00 • committed by mara
commit 4cdf807afc
9 changed files with 777 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

33
nix/module-eval/bao-grants.nix
View file

@ -1558,6 +1558,39 @@ let
in
lib.hasInfix "path \"secret/data/swarm/agents/*\" {\n capabilities = [\"create\", \"read\", \"update\"]" s;
}
{
# `agent_entity.rs` names each agent's login entity after the agent. The
# accessor read is `read` + `sudo` on the one mount, the lookup and both
# writes list the request keys they take (so `policies`, which would
# attach any policy to a login, is refused), and nothing else under
# `identity/` or `sys/auth` is reachable. Pinned as whole stanzas and as
# the exact list of identity and sys/auth paths, so a wider glob or an
# added path fails.
name = "the controller's identity grants are the five stanzas agent_entity.rs needs and nothing else";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
pathsUnder =
prefix: lib.filter (l: lib.hasPrefix "path \"${prefix}" l) (map lib.trim (lib.splitString "\n" s));
in
lib.hasInfix "path \"sys/auth/cert\" {\n capabilities = [\"read\", \"sudo\"]\n}" s
&& lib.hasInfix "path \"identity/lookup/entity\" {\n capabilities = [\"update\"]\n allowed_parameters = {\n \"alias_name\" = []\n \"alias_mount_accessor\" = []\n }\n}" s
&& lib.hasInfix "path \"identity/entity/name/+\" {\n capabilities = [\"create\", \"read\", \"update\"]\n allowed_parameters = {\n \"name\" = []\n }\n}" s
&& lib.hasInfix "path \"identity/entity/id/+\" {\n capabilities = [\"update\"]\n allowed_parameters = {\n \"name\" = []\n }\n}" s
&& lib.hasInfix "path \"identity/entity-alias\" {\n capabilities = [\"create\", \"update\"]\n allowed_parameters = {\n \"name\" = []\n \"mount_accessor\" = []\n \"canonical_id\" = []\n }\n}" s
&&
pathsUnder "identity/" == [
"path \"identity/lookup/entity\" {"
"path \"identity/entity/name/+\" {"
"path \"identity/entity/id/+\" {"
"path \"identity/entity-alias\" {"
]
&& pathsUnder "sys/auth" == [ "path \"sys/auth/cert\" {" ]
# The control: the same walk finds the policy-namespace stanza that is
# there, so an empty result above means nothing else exists rather than
# that the walk reads nothing.
&& pathsUnder "sys/policies/acl/" == [ "path \"sys/policies/acl/hive-*\" {" ];
}
{
# `matrix_account::hive_sender` writes every hive's sender token and
# `forge::hive_token` every hive's forge token, and nothing else under