vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

state the heal_own_dir cause in the backend env comments

Browse source
This commit is contained in:
atlas 2026-10-28 02:22:55 +01:00
commit ca194f5c91
1 changed files with 9 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

11
swarm-secret-client/src/policy.rs
View file

@ -209,11 +209,12 @@ const ENTITY_NAME_TEMPLATE: &str = "{{identity.entity.name}}";
/// process holds the identity, so while the leaf is empty it can also create it
/// with any text, and the store's value then wins over the file. That is no
/// wider than the harness-dir file the agent already owns:
/// `nix/agent-modules/user.nix`'s `heal_own_dir` chowns that dir to the agent at
/// every activation, a gap the issue tracker has an open bug for. Any other
/// write would let an agent hand itself an identity it was never issued. An agent has no business with another agent's
/// credentials, a hive's, a service's, or the controller's, so none of
/// [`render_shared_hives`]'s breadth applies. A hive still reads this
/// the container activation's `heal_own_dir` (`nix/agent-modules/user.nix`)
/// re-owns that dir to the agent recursively at every boot, so the agent
/// already controls the legacy file. Any other write would let an agent hand
/// itself an identity it was never issued. An agent has no business with
/// another agent's credentials, a hive's, a service's, or the controller's, so
/// none of [`render_shared_hives`]'s breadth applies. A hive still reads this
/// agent's secrets, and closing that is its own decision.
#[must_use]
pub fn render_shared_agent() -> String {