vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm: revoke an agent's queue credential when it is declared destroyed

Browse source 
A per-agent queue credential is minted at agent creation and nothing has
ever removed it. An agent declared destroyed loses its container and
keeps its credential: a bearer secret recovered from a snapshot or a
stale capture still authenticates as that agent, so the set of usable
credentials only grows.

Delete the path the mint published, on the one transition that ends an
agent's life. It mirrors step 3 of `mint_and_verify` and no other step:
the leaf, the ACL document and the cert role are what a hive uses to
collect an agent's secrets and are re-minted on every run of the mint.

Every version, not the newest. The mint rewrites the path when the
principal it names needs correcting, so KV v2's plain delete would leave
the identical secret readable at ?version=N. That is a separately-ACL'd
path, hence the second stanza in the controller's grant -- `delete` on
metadata discloses nothing, and `update` on the data path already lets
this principal destroy any agent credential's usability.

The destroy is not blocked by a failed revocation: the declaration is
already published and refusing the call would leave an operator with an
agent they cannot tear down. The failure is logged at error instead,
naming the agent, since a silent orphan is the fault being removed.
This commit is contained in:
atlas 2026-09-23 11:56:30 +02:00 • committed by mara
commit 8caf688ee4
5 changed files with 229 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/module-eval/bao-grants.nix
View file

@ -1147,6 +1147,25 @@ let
in
lib.hasInfix "path \"secret/data/swarm/agents/*\" {\n capabilities = [\"create\", \"read\", \"update\"]" s;
}
{
# Revocation, and the reason it is a stanza of its own: `delete` on the
# `data/` path soft-deletes the newest version and leaves earlier ones
# readable, so a credential the mint had ever rewritten would survive it.
# `metadata/` is the path that removes every version, and the store ACLs
# it separately — without this grant the revocation is a 403 and a
# destroyed agent's credential stays valid.
#
# Pinned as the whole capability list for the same reason as the stanza
# above: `read` or `list` here would hand a write-only principal the
# version history of every agent's secrets.
name = "the controller may revoke an agent credential, and only by removing every version of it";
ok =
let
s = baoGrantHere.systemd.services.swarm-bao-controller-policy.script;
in
lib.hasInfix "path \"secret/metadata/swarm/agents/*\" {\n capabilities = [\"delete\"]" s
&& !(lib.hasInfix "secret/metadata/*" s);
}
{
# The swarm appservice token is a homeserver-admin credential. The
# controller mints agents' accounts with it and has no business replacing