From 7e83d906b2cd8b480346f7ef5d32d8455f9ee43e Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 4 Jul 2026 13:07:54 +0200 Subject: [PATCH] =?UTF-8?q?fix(#1845):=20upgrade=20hive-c0re=20ProtectSyst?= =?UTF-8?q?em=20full=20=E2=86=92=20strict?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hive-c0re never writes outside its StateDirectory + RuntimeDirectory: - /etc writes (nixos-containers) go through hive-priv, not c0re - /etc/hyperhive/serve.json is read-only at startup (written by the NixOS activation script, not by the daemon) - nix builds delegate to hive-priv via the privileged Unix socket; hive-c0re itself never invokes nix directly So strict is safe: systemd keeps /var/lib/hyperhive (StateDirectory) and /run/hyperhive (RuntimeDirectory) writable; everything else is read-only, shrinking the writable attack surface to exactly what the service needs. --- nix/modules/hive-c0re.nix | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix index c0119b40..5adf840d 100644 --- a/nix/modules/hive-c0re.nix +++ b/nix/modules/hive-c0re.nix @@ -1104,13 +1104,16 @@ in NoNewPrivileges = true; # already runs as unprivileged user PrivateTmp = true; # uses StateDirectory for tmpfiles, not /tmp ProtectHome = true; # HOME = /var/lib/hyperhive; no /home/* access needed - # "full" makes /usr, /etc, /boot read-only. Safe: c0re never - # writes to any of those paths directly — all /etc writes (e.g. - # /etc/nixos-containers) go through hive-priv, and reads from - # /etc/hyperhive/serve.json are read-only. "strict" (everything - # read-only) requires carefully auditing ReadWritePaths for every - # nix store path c0re touches and is deferred to a follow-up. - ProtectSystem = "full"; + # "strict" makes the entire filesystem read-only except for + # StateDirectory (/var/lib/hyperhive) and RuntimeDirectory + # (/run/hyperhive), which systemd keeps writable. hive-c0re + # never writes to /usr, /etc, /boot, /run (other than its own + # RuntimeDirectory), or /nix — all /etc writes go through + # hive-priv, /etc/hyperhive/serve.json is read-only at startup, + # and the service never calls nix directly (builds delegate to + # hive-priv via the privileged socket). No ReadWritePaths needed + # beyond the managed directories. + ProtectSystem = "strict"; ProtectKernelTunables = true; # no sysctl writes ProtectKernelLogs = true; # reads logs via systemd-journal group, not /dev/kmsg ProtectControlGroups = true; # cgroup writes go through hive-priv, not c0re directly