vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: move privsep socket-activation + child-state rw rationale out of code comments

Browse source
This commit is contained in:
damocles 2026-06-08 20:04:05 +02:00 • committed by mara
commit fb1f7efbe4
4 changed files with 40 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

11
hive-priv/src/main.rs
View file

@ -57,14 +57,9 @@ async fn main() -> Result<()> {
}
fn socket_listener() -> Result<UnixListener> {
// hive-priv is ALWAYS socket-activated: systemd's `hive-priv.socket`
// unit binds `/run/hive/priv.sock` (SocketGroup=hive-core, mode 0660)
// and passes it as fd 3 via LISTEN_FDS. We require that — there is
// intentionally no self-bind fallback, so dev and prod take the exact
// same path. (The old fallback re-bound the socket itself as root's
// primary group, never `hive-core`, so a hive-core client couldn't
// connect the way the socket unit's grant intends; dropping it removes
// that dev/prod divergence.)
// hive-priv is ALWAYS socket-activated by the `hive-priv.socket` unit
// (fd 3 via LISTEN_FDS). There is intentionally no self-bind fallback,
// so dev and prod take the same path; see docs/boundary.md.
let listen_fds: Option<i32> = std::env::var("LISTEN_FDS")
.ok()
.and_then(|s| s.parse().ok());