5ca96b8c85
All five files scrubbed to 0 issue-ref cookies. Most refs were '(closes #NNN)' style attribution after closed work landed. - docs/turn-loop.md: 6 → 0 (#598 unified binary, #419 auth-fail, #542 mtime resumption, #519 role markers, #442 spawn path, #474/#478 partial edit) - docs/approvals.md: 5 → 0 (#317 flake validation, #250 withdraw, #441 rebuild-queue dispatch, #753 manager port hash, #425 crash-watch grace) - docs/terminal-rendering.md: 2 → 0 (#666 ask-operator inline) - docs/conventions.md: 3 → 0 (#753 port hash, #692 parent sentinel, #486 reparenting) - docs/security.md: 4 → 0 (#240 + #658 ×2 + #673/#678 attribution) Combined with PR #810 (docs/web-ui.md 14→0), this PR closes the small / medium files. Remaining: agent-hierarchy.md (13), gotchas.md (13), persistence.md (13). gateway.md is atlas's lane.
36 lines
1.6 KiB
Markdown
36 lines
1.6 KiB
Markdown
# Security model
|
|
|
|
## Nix builds and credential isolation
|
|
|
|
### Background
|
|
|
|
Agent containers bind-mount the host's `nix-daemon` socket. The host daemon may
|
|
have `sandbox-fallback = false` (strict NixOS defaults), which causes `nix build`
|
|
inside nspawn containers to fail — containers lack kernel user namespaces, so nix
|
|
cannot set up its build sandbox. `harness-base.nix` sets `sandbox-fallback = true`
|
|
so that builds fall back to unsandboxed execution rather than failing outright.
|
|
|
|
### Threat model
|
|
|
|
Unsandboxed nix builds run as `nixbld` users (non-root, typically UIDs 30001-30010).
|
|
Without sandbox isolation, a build derivation's builder script has read access to
|
|
any file in the container that the nixbld user can read.
|
|
|
|
**What is NOT exposed**:
|
|
|
|
- `/home/<name>/.claude/` — mode `0700`, owned by the per-agent
|
|
user `<name>`. nixbld users cannot read it.
|
|
- `$HYPERHIVE_STATE_DIR/forge-token` (= `/agents/<name>/state/forge-token`)
|
|
— written at mode `0600` by `hive-c0re/src/forge.rs` and chowned to the
|
|
per-agent uid:gid by `lifecycle::chown_to_agent`. nixbld users
|
|
cannot read it.
|
|
|
|
**Policy**: all credential files written to agent state directories MUST be mode
|
|
`0600` or stricter. Do not create world-readable secret files in agent state dirs.
|
|
|
|
### Long-term fix
|
|
|
|
The proper fix is to enable user namespaces inside nspawn containers
|
|
(`--private-users=inherit` in `EXTRA_NSPAWN_FLAGS`) so nix can set up its real
|
|
sandbox and `sandbox-fallback` becomes a true last resort. This requires verifying
|
|
bind-mount compatibility with user namespace UID mapping and is tracked as a TODO.
|