# hive-priv

The minimal **root privileged-helper** for hive-c0re. It runs as root and
exposes a narrow unix socket at `/run/hive/priv.sock` that accepts `PrivRequest`
JSON lines and performs only the handful of operations that genuinely require
root — bind-mount edits, `nsenter` into a container, btrfs subvolume ops. All
coordination logic (broker, HTTP, scheduling) stays in the *unprivileged*
`hive-c0re` process, which delegates here.

## Why it exists

Privsep. `hive-c0re` runs as the unprivileged `hive-core` user so a bug or a
prompt-injection in the large daemon can't directly wield root. The few root
operations it needs are funnelled through this small, auditable helper instead.
See `docs/boundary.md` and `docs/security.md` for the privilege boundary.

## Security model

- **Strict allowlist.** Every request is validated against a container-name
  allowlist before any filesystem or process operation — only names matching the
  hive convention (`h-*`, the manager container, known sibling service
  containers) are accepted.
- **No pass-through.** Every `PrivRequest` variant maps to a single known
  operation; there is no arbitrary-command escape hatch.
- **Socket-activated, always.** systemd binds `/run/hive/priv.sock`
  (`SocketGroup=hive-core`, `0660`) and passes the listener as fd 3
  (`LISTEN_FDS`); the helper requires this and has no self-bind fallback, so dev
  and prod take the identical path and the group grant always holds.

The wire contract (`PrivRequest` / response types) lives in the separate
`hive-priv-sock` crate so this root binary depends on just the protocol shapes,
not the whole daemon-shared crate.