vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-controller: restrict its socket directory to nginx's access group

Browse source
This commit is contained in:
atlas 2026-10-17 13:54:14 +02:00
commit 51cc093465
4 changed files with 63 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

9
swarm-controller/src/main.rs
View file

@ -3468,10 +3468,11 @@ async fn main() -> Result<()> {
// 0666 matches how hive-c0re publishes the per-agent sockets
// (`socket_server::start`), and rests on the same argument: **the
// containing directory is the access control, not the socket mode.**
// This directory holds one socket and is bind-mounted into exactly
// one container. That is also why it must not be shared with
// hive-c0re's `/run/hyperhive` — with a 0666 socket, a directory
// that carries more than it should is the whole vulnerability.
// The unit makes the directory `0750`, group `swarm-controller-clients`,
// so only nginx and root reach the socket. The directory holds one
// socket, which is also why it must not be shared with hive-c0re's
// `/run/hyperhive` — with a 0666 socket, a directory that carries
// more than it should is the whole vulnerability.
std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o666))
.with_context(|| format!("chmod {}", path.display()))?;
tracing::info!(socket = %path.display(), "swarm-controller listening");