From 80c33f5108f630a402fcc52d6cc92746d9b17cac Mon Sep 17 00:00:00 2001 From: iris Date: Tue, 23 Jun 2026 13:52:56 +0200 Subject: [PATCH] docs(security): drop redundant bootstrap-container allowlist entry MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The hive-priv container allowlist's explicit MANAGER_NAME allow is redundant — the bootstrap container's name passes the generic agent-name char validation anyway. Describe the allowlist as just the agent-name convention + the sibling service containers. --- docs/security.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/security.md b/docs/security.md index 14fd6d44..02853500 100644 --- a/docs/security.md +++ b/docs/security.md @@ -109,10 +109,10 @@ known operations; there is no arbitrary command pass-through: | `RestartMatrixDaemon` | `systemctl --machine=h- restart hive-matrix-daemon.service` | **Container allowlist** — every request is validated against an -allowlist before any operation: only names matching `h-` (the -standard agent prefix), the root/bootstrap container, or the known sibling -service containers (`hive-gateway`, `hive-forge`, `hive-matrix`, -`hive-ci`) are accepted. Arbitrary container names are rejected. +allowlist before any operation: only names matching the agent-name +convention (char-validated) or the known sibling service containers +(`hive-gateway`, `hive-forge`, `hive-matrix`, `hive-ci`) are accepted. +Arbitrary container names are rejected. **Socket-activated** — systemd starts `hive-priv` on the first incoming connection (`LISTEN_FDS=1`); it is not running between calls.