vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

hive-c0re: grant hive-admin group a polkit rule for choom

Browse source
This commit is contained in:
damocles 2026-09-07 23:27:15 +02:00
commit 66c3138dd1
3 changed files with 89 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/tools/hivectl.md
View file

@ -214,11 +214,15 @@ new containers and restarts pick the values up immediately.
Drop into an interactive Claude session inside an agent container.
Replaces the current process with `machinectl shell <name>@h-<name>`
running claude from the agent's state dir. Requires root (same as all
`machinectl shell` operations) — hyperhive ships no polkit rule granting
those actions to the operator group, so `choom` refuses up front with a
message naming that requirement rather than letting systemd reject the
exec later.
running claude from the agent's state dir. Requires root, or membership in
`hive-admin` (the same sudoless-`hivectl` group as the [host admin
socket](../trust-boundary/boundary.md) — hive-c0re ships a polkit rule
granting that group the one action `machinectl shell` needs); `choom`
checks this itself and refuses up front with a message naming the
requirement rather than letting systemd reject the exec later with an
opaque polkit prompt. Same caveat as the socket grant: a shell opened
before you were added to `hive-admin` won't see it until you log back in
— secondary group membership applies at login.
It also needs the daemon socket, unlike the other exec-into-a-container
paths: the "is this actually an agent?" pre-flight reads the agents root,