| Filename | Latest commit message | Latest commit date |
|---|---|---|
3fc1588e83
/run/hive-agent/<name> was 0777 root root in steady state, not just during first spawn. A directory without the sticky bit lets any user unlink files in it, and the gateway container has all of /run/hive-agent bind-mounted in, so anything that could reach the path could delete an agent's agent.sock, bind its own, and receive that agent's todos from hive-c0re. Two mechanisms were writing the dir and undoing each other: the tmpfiles.d entry wrote 0777 root root, then hive-c0re round-tripped through hive-priv's ChownSocketDir to narrow it. `d` re-asserts mode and owner on every apply and the file is regenerated on any agent's spawn or destroy, so every such event reset every agent's dir back to world-writable. SyncAgentTmpfiles now carries each agent's container uid/gid and the entry declares the answer: 0751 <uid> <gid>. Three principals need the dir and no two share a group -- the harness binds its sockets (owner rwx), hive-c0re dials agent.sock and the gateway's nginx dials web.sock (both only need traverse, and both sockets are already 0666). Deletes ChownSocketDir and ChmodSocketDir, both priv_client wrappers, the either/or in host_config with its two swallowed warn!s, and the now-dead socket_dir_path -- two verbs off the privileged helper's surface and one round-trip off every agent spawn. Also makes the two tmpfiles rules for /run/hive-agent itself agree: the gateway module said hive-core, the generated file said root, and which won depended on the order systemd read them in. |
||
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
hive-priv-sock
Wire types for the hive-priv privileged-helper socket
(/run/hive/priv.sock) — the contract between hive-priv (the root helper,
server) and hive-c0re (client, via its priv_client).
Why it's its own crate
Split out of hive-sh4re so hive-priv — a root-privileged binary —
depends on just this narrow protocol crate instead of the much larger
daemon-shared crate. Two wins: fewer dependencies in a root process's supply
chain, and a small, self-contained interface makes the privilege boundary this
crate encodes easier to audit. Mirrors hive-host-sock's split for the host
admin socket.
Shape
Serde-derived request/response types only — no server or client logic. Both
sides import them so the shapes stay in sync. See docs/boundary.md +
docs/security.md for the privilege boundary these types sit on, and
hive-priv/README for the helper itself.