From 8571e3243aa0c01aec2671d3d6a9411a74361db2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?m=C3=BCde?= Date: Sat, 30 May 2026 23:15:16 +0200 Subject: [PATCH] c0re: chmod 0666 mcp.sock after bind so in-container agent user can connect (#658 fixup) --- hive-c0re/src/agent_server.rs | 9 +++++++++ hive-c0re/src/manager_server.rs | 5 +++++ 2 files changed, 14 insertions(+) diff --git a/hive-c0re/src/agent_server.rs b/hive-c0re/src/agent_server.rs index cbf763ad..f6ae52d3 100644 --- a/hive-c0re/src/agent_server.rs +++ b/hive-c0re/src/agent_server.rs @@ -29,6 +29,15 @@ pub fn start(agent: &str, socket_path: &Path, coord: Arc) -> Result } let listener = UnixListener::bind(socket_path) .with_context(|| format!("bind agent socket {}", socket_path.display()))?; + // The socket is bind-mounted into exactly one container as + // `/run/hive/mcp.sock` (`lifecycle::set_nspawn_flags`); post-#658 + // the in-container harness connects as the per-agent unix user, + // not root, so the default `tokio::net::UnixListener::bind` perms + // (0755) lock it out. 0666 lets the agent user connect; the bind + // source dir is per-agent on host so blast radius is unchanged. + use std::os::unix::fs::PermissionsExt as _; + std::fs::set_permissions(socket_path, std::fs::Permissions::from_mode(0o666)) + .with_context(|| format!("chmod agent socket {}", socket_path.display()))?; tracing::info!(%agent, socket = %socket_path.display(), "agent socket listening"); let path = socket_path.to_path_buf(); diff --git a/hive-c0re/src/manager_server.rs b/hive-c0re/src/manager_server.rs index 3eb20919..9d253e2d 100644 --- a/hive-c0re/src/manager_server.rs +++ b/hive-c0re/src/manager_server.rs @@ -23,6 +23,11 @@ pub fn start(coord: Arc) -> Result<()> { } let listener = UnixListener::bind(&socket) .with_context(|| format!("bind manager socket {}", socket.display()))?; + // 0666 so the in-container hm1nd user (post-#658) can connect; + // the bind source dir is manager-only on host. See agent_server.rs. + use std::os::unix::fs::PermissionsExt as _; + std::fs::set_permissions(&socket, std::fs::Permissions::from_mode(0o666)) + .with_context(|| format!("chmod manager socket {}", socket.display()))?; tracing::info!(socket = %socket.display(), "manager socket listening"); tokio::spawn(async move {