vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix(#2733): write the agent pause marker via hive-priv

Browse source 
`Coordinator::set_paused` wrote the marker directly with `std::fs::write`
from hive-c0re, which runs as the unprivileged `hive-core` user. The
agent's harness dir is chowned to the agent user on every container boot
(`user.nix`'s activation chown), mode 0755 — so hive-core can stat the
marker but gets EACCES creating or unlinking it. Pause therefore only
ever worked on an agent that had never booted; the read side works
because a stat needs traverse, not write, which is why the paused pill
and `is_paused` looked healthy.

Route both directions through hive-priv, the root helper that already
owns the other writes into agent-owned directories:

- `PrivRequest::SetAgentPaused { agent_name, paused }`, with the marker
  filename constant moved to hive-priv-sock. That is the narrowest crate
  all three sides share (hive-priv deliberately does not depend on
  hive-sh4re, which re-exports it for the in-container resolver). A
  private copy on any one side would break pause silently, since every
  reader just sees "no marker".
- `write_agent_state_file` generalised to `write_agent_dir_file`, taking
  the target directory: `state/` and `harness/` are both agent-owned,
  which is the same reason both need root.
- resume unlinks via `remove_file`, which acts on the leaf and never
  follows a symlink — an agent could otherwise plant a link at the
  marker path and have root delete an arbitrary file.

`Coordinator::set_paused` becomes an async round-trip; its three call
sites were already async. Both directions stay idempotent because the
dashboard toggle and `hivectl pause|resume` fire without reading the
current state first.
This commit is contained in:
atlas 2026-07-26 23:50:05 +02:00 • committed by mara
commit de09628c7c
9 changed files with 193 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

36
hive-c0re/src/coordinator.rs
View file

@ -1382,32 +1382,26 @@ impl Coordinator {
Self::agent_paused_marker(name).exists()
}
/// Create or remove the pause marker. Idempotent in both
/// directions: pausing an already-paused agent (or resuming a
/// Create or remove the pause marker, **via hive-priv**. Idempotent in
/// both directions: pausing an already-paused agent (or resuming a
/// running one) is a no-op rather than an error, so the dashboard
/// toggle and `hivectl pause|resume` don't have to read-then-write.
///
/// The write cannot happen in-process. The harness dir is chowned to
/// the agent user on the container's first boot (mode 0755), and this
/// daemon runs as the unprivileged `hive-core` user — so the read side
/// ([`Self::is_paused`], a stat) works while a direct `fs::write` here
/// fails with `EACCES` on every agent that has ever booted. The root
/// helper owns both directions instead.
///
/// # Errors
///
/// Returns the underlying `io::Error` when the marker can't be
/// created (agent dir missing and un-creatable, permissions, disk
/// full) or can't be removed. A `NotFound` on removal is *not* an
/// error — that's the idempotent resume case.
pub fn set_paused(name: &hive_types::Ident, paused: bool) -> std::io::Result<()> {
let marker = Self::agent_paused_marker(name);
if paused {
if let Some(parent) = marker.parent() {
std::fs::create_dir_all(parent)?;
}
// `create_new` would fail on the second pause; truncating an
// existing empty marker is the idempotent equivalent.
std::fs::write(&marker, b"")
} else {
match std::fs::remove_file(&marker) {
Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
other => other,
}
}
/// Returns the hive-priv error when the marker can't be created (agent
/// dir missing and un-creatable, disk full) or can't be removed, and
/// the transport error when the helper is unreachable. A `NotFound` on
/// removal is *not* an error — that's the idempotent resume case.
pub async fn set_paused(name: &hive_types::Ident, paused: bool) -> anyhow::Result<()> {
crate::priv_client::set_agent_paused(name.as_str(), paused).await
}
/// Enumerate names that have a persistent state dir under