From 8e2f311e09a5844daf2e6c66724740dfce92ceff Mon Sep 17 00:00:00 2001 From: damocles Date: Mon, 1 Jun 2026 15:52:28 +0200 Subject: [PATCH] fix(#924): set web socket mode to 0o666 so gateway nginx can connect --- hive-ag3nt/src/web_ui.rs | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/hive-ag3nt/src/web_ui.rs b/hive-ag3nt/src/web_ui.rs index 3a84f613..d1b51587 100644 --- a/hive-ag3nt/src/web_ui.rs +++ b/hive-ag3nt/src/web_ui.rs @@ -164,9 +164,11 @@ pub async fn serve( /// Best-effort unlinks any stale socket left from a crashed previous /// harness (clean exit removes it, but `bind(2)` refuses to overwrite /// an existing file) and `mkdir -p`s the parent for first-boot. Mode -/// `0o660` so a peer container bind-mounting the dir with a shared -/// group can `connect(2)`; the bind-mount source dir's ownership + -/// ACL is the real access gate. +/// `0o666` — world-accessible so the gateway container's nginx process +/// can `connect(2)` without sharing a group with the agent user. +/// The per-agent subdir (`/run/hive-agent//`) is only accessible +/// to containers that have it bind-mounted, so world-accessible sockets +/// are not a material risk. /// /// Marker-gating + the gateway-side consumer: see /// [`docs/gateway.md::Per-agent unix-socket upstream`](../../../docs/gateway.md). @@ -182,7 +184,7 @@ fn bind_unix(path: &Path) -> Result { let listener = tokio::net::UnixListener::bind(path) .with_context(|| format!("bind unix socket at {}", path.display()))?; use std::os::unix::fs::PermissionsExt; - std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o660)) + std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o666)) .with_context(|| format!("set perms on {}", path.display()))?; // Best-effort ready marker: failed write isn't fatal (the harness // still binds + serves), it just means the gateway side keeps the