From b3b1c7b288a8ef34723d485516ced34ce7fa0ef0 Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 4 Jul 2026 11:37:10 +0200 Subject: [PATCH] fix(#1845): add safe systemd hardening directives to hive-c0re service MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit hive-c0re runs as the unprivileged hive-core user and delegates all privileged operations to hive-priv via a Unix socket. Add the subset of systemd sandboxing directives that are provably safe without a watched deploy (no ProtectSystem / RestrictAddressFamilies, which require mapping the full set of filesystem/network paths first): - NoNewPrivileges: already unprivileged; no setuid/capability escalation - PrivateTmp: nix subprocesses use StateDirectory temp paths, not /tmp - ProtectHome: HOME is /var/lib/hyperhive (StateDirectory), not /home/* - ProtectKernelTunables: no sysctl writes needed - ProtectKernelLogs: logs via systemd-journal group, not /dev/kmsg - ProtectControlGroups: cgroup writes go through hive-priv, not c0re - RestrictNamespaces: namespace creation goes through hive-priv - LockPersonality: no personality changes needed - RestrictRealtime: no real-time scheduling Follows the same pattern as hive-priv (PrivateTmp + ProtectHome already present there). Deferred: ProtectSystem=strict + ReadWritePaths + RestrictAddressFamilies — those need a watched deploy per the #1845 plan since getting the ReadWritePaths wrong silently breaks runtime I/O. --- nix/modules/hive-c0re.nix | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix index 233cec1e..c2c1452e 100644 --- a/nix/modules/hive-c0re.nix +++ b/nix/modules/hive-c0re.nix @@ -1094,6 +1094,22 @@ in RuntimeDirectoryPreserve = "yes"; StateDirectory = "hyperhive"; StateDirectoryMode = "0750"; + # Sandboxing. hive-c0re is unprivileged (runs as hive-core, never + # setuid), makes HTTP requests to forge/matrix/Anthropic (keeps INET), + # and delegates all privileged ops to hive-priv via a Unix socket. + # These directives deny the subset of kernel capabilities it + # provably doesn't need without restricting its network or + # filesystem access (ProtectSystem / RestrictAddressFamilies are + # deferred to a follow-up with a watched deploy — see #1845). + NoNewPrivileges = true; # already runs as unprivileged user + PrivateTmp = true; # hive-c0re and its nix subprocesses use tmpfiles under StateDirectory, not /tmp + ProtectHome = true; # HOME = /var/lib/hyperhive (StateDirectory); no /home/* access needed + ProtectKernelTunables = true; # no sysctl writes + ProtectKernelLogs = true; # reads logs via systemd-journal group, not /dev/kmsg + ProtectControlGroups = true; # cgroup writes go through hive-priv, not c0re directly + RestrictNamespaces = true; # namespace creation goes through hive-priv + LockPersonality = true; # no personality changes needed + RestrictRealtime = true; # no real-time scheduling }; };