vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-logs-auth: run as a static user so nginx reaches its socket

Browse source 
With DynamicUser=true and RuntimeDirectoryPreserve=yes, systemd creates
the unit's runtime directory under /run/private/ (0700 root:root) and
symlinks /run/swarm-logs-auth to it (systemd.exec(5),
RuntimeDirectoryPreserve=). nginx runs as the unprivileged nginx user, so
its connect() to /run/swarm-logs-auth/auth.sock failed with EACCES, the
auth subrequest ended in a 502, and auth_request answered every agent
bearer on /select/logsql/ with a 500.

The unit now runs as a static swarm-logs-auth system user and group, the
shape swarm-controller already uses for its 0751 + Preserve socket dir.
RestrictSUIDSGID and RemoveIPC, which DynamicUser implied and the unit
did not set itself, are set explicitly.

module-eval-core-toggle gains a case that fails when any unit creating
the runtime directory of a unix: upstream of nginx combines DynamicUser
with RuntimeDirectoryPreserve. docs/process/gotchas.md records the trap.

Fixes #5235
This commit is contained in:
atlas 2026-10-14 16:40:43 +02:00 • committed by mara
commit b807189692
3 changed files with 66 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/process/gotchas.md
View file

@ -75,6 +75,17 @@ the path entry resolves to `/run/wrappers/bin/bin` instead.
hive-c0re restarts. Without it, every restart wipes bind sources and
existing containers fail to start.
### `DynamicUser` + `RuntimeDirectoryPreserve` hides the socket from nginx
With both set, systemd creates the runtime directory under `/run/private/`
(`0700 root:root`) and symlinks `/run/<name>` to it (`systemd.exec(5)`,
`RuntimeDirectoryPreserve=`). No unprivileged user can traverse that, so
nginx's `connect()` to a socket in it fails with `EACCES` whatever the
directory and socket modes are. A unit serving a socket to another user
runs as a static user instead (`swarm-controller`, `swarm-logs-auth`).
`module-eval-core-toggle` fails on any `unix:` upstream of nginx owned by
such a unit.
### `RestrictAddressFamilies` fails as "Address family not supported by protocol"
A unit whose `RestrictAddressFamilies` omits a family gets `EAFNOSUPPORT`