vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

matrix: pin tuwunel gid 10042, chown root:tuwunel + 0640 on token (#644 mara veto on 0644)

Browse source
This commit is contained in:
damocles 2026-05-30 18:42:39 +02:00
commit 88b4634906
2 changed files with 44 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

17
hive-c0re/src/matrix.rs
View file

@ -123,13 +123,16 @@ pub fn ensure_register_token() -> Result<String> {
}
std::fs::write(path, format!("{token}\n"))
.with_context(|| format!("write registration token to {}", path.display()))?;
// Mode 0644: tuwunel inside the hive-matrix container runs as its
// own dynamic user (not root), so the bind-mounted file needs to
// be world-readable for tuwunel to load it. 0600 root-owned would
// block tuwunel with `Permission denied (os error 13)` (#644). On
// a single-tenant host the trade-off is acceptable; multi-tenant
// would need group-readable with explicit gid matching.
let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o644));
// Mode 0640: tuwunel inside the hive-matrix container runs as a
// non-root user; the file gets `chown :tuwunel` via the activation
// script in `nix/modules/hive-matrix.nix` so the tuwunel group
// gains read. 0600 would block tuwunel with `Permission denied
// (os error 13)` (#644); 0644 would world-read the token (mara
// veto: footgun). 0640 with a pinned group is the sweet spot.
// The host-side activation script also chowns + chmods on every
// boot, so this is best-effort: hive-c0re may write the file
// before the chown lands, but the next activation reconciles it.
let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o640));
tracing::info!(path = %path.display(), "matrix: generated registration token");
Ok(token)
}