| Filename | Latest commit message | Latest commit date |
|---|---|---|
ec4ba4c7fa
First half of the fd-passing work, and deliberately the half with the real failure mode in it. No syscalls here — the caller does the recvmsg and feeds this (bytes, fds); it hands back complete messages paired with the descriptor each one owns. Association is the whole point. A descriptor does not arrive neatly paired with the request that wants it: recvmsg returns whatever bytes happen to be available plus whatever ancillary data rode along, so a descriptor can arrive with a chunk holding only part of its request's line, with a chunk whose bytes finish the previous request, ahead of any of its own bytes, or alongside several complete requests at once. Pairing "the fd from this chunk" with "the request in this chunk" is therefore wrong in the worst way: the types are identical either way, so nothing catches it, and the failure is one request executing against another's descriptor — in this process, writing one agent's state into a different transfer's socket. So descriptors queue on arrival and each message claims the oldest unclaimed one at the moment it completes. Two consequences worth stating: a line that fails to decode does NOT consume a descriptor (closing it there would destroy something belonging to a request nobody processed), and unclaimed descriptors are drainable so the teardown path can close them instead of leaking one per abandoned message in a long-lived helper. Lives in hive-priv-sock, not hive-priv: clippy's dead-code error was right that an unwired module doesn't belong in the binary, and chasing that produced the better home anyway — both ends need this. The daemon sends descriptors and the helper reassembles them, so framing is part of the wire contract rather than one side's implementation detail. |
||
| .. | ||
| src | ||
| Cargo.toml | ||
| README.md | ||
hive-priv-sock
Wire types for the hive-priv privileged-helper socket
(/run/hive/priv.sock) — the contract between hive-priv (the root helper,
server) and hive-c0re (client, via its priv_client).
Why it's its own crate
Split out of hive-sh4re so hive-priv — a root-privileged binary —
depends on just this narrow protocol crate instead of the much larger
daemon-shared crate. Two wins: fewer dependencies in a root process's supply
chain, and a small, self-contained interface makes the privilege boundary this
crate encodes easier to audit. Mirrors hive-host-sock's split for the host
admin socket.
Shape
Serde-derived request/response types only — no server or client logic. Both
sides import them so the shapes stay in sync. See docs/boundary.md +
docs/security.md for the privilege boundary these types sit on, and
hive-priv/README for the helper itself.