From 5fbd89c0621ff24a8ec728a06fd9de23eb721469 Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 9 Oct 2026 00:55:54 +0200 Subject: [PATCH] Issue 339: the gate reads a directory used as found as a wait for a person; the trust anchors are the terminal's --- .../01-diagnosis.md | 34 +++++++++++++++---- 1 file changed, 27 insertions(+), 7 deletions(-) diff --git a/04-ISSUES/339-a-verb-can-place-a-directory-at-the-machines-own/01-diagnosis.md b/04-ISSUES/339-a-verb-can-place-a-directory-at-the-machines-own/01-diagnosis.md index 8fd8ea14..eda8292b 100644 --- a/04-ISSUES/339-a-verb-can-place-a-directory-at-the-machines-own/01-diagnosis.md +++ b/04-ISSUES/339-a-verb-can-place-a-directory-at-the-machines-own/01-diagnosis.md @@ -119,20 +119,40 @@ Until the node-engine's follow-up (below) lands, the only trace is that one outc `encoding/pem` decodes (label CERTIFICATE, no headers) and `x509.ParseCertificate` parses. - Vertical tab, form feed, NEL and the Unicode line and paragraph separators are refused alongside line breaks, carriage returns and NUL. - - The spool, `/opt`, the container runtimes' data and any `.ssh` are added to the paths no placement or - access may name. + - The spool, `/opt`, the container runtimes' data (`/var/lib/docker`, `/var/lib/containers`, + `/var/lib/containerd`) and any `.ssh` are added to the paths no placement or access may name. + - **The mesh's trust anchors are the terminal's too**, refused through every verb route exactly as + `places` and `accesses` are: + - step-ca's `root`, `roots` and `path`: the root its consumers are handed, and where they fetch the roots + and the ACME directory; + - the identity provider's `issuer`: the issuer every OIDC consumer checks a login's token against. + + Before this, any caller of the settings verb could replace the internal authority's trust anchor or the + issuer. The catalogue was read on 2026-10-09 for every served fact and every setting a file asks for, and + these are the ones a consumer trusts. They are named in the controller (`TerminalKeys`), because no manifest + field says "this is trusted" yet. - **`mesh-host`, a directory used as found is said:** - a WARNING line in every apply's log; - its module's resource of kind `directory`, stated unhealthy on every look, with its owner, its mode and what was declared. The controller raises that as the module's condition, naming the directory. - `mesh-host hand-over `, run by a person at the machine, hands it to the mesh. The next apply gives - it the declared owner and mode. + it the declared owner and mode. A hand-over names the resource it was for, so it lapses if another + declaration later points another resource at the same path. - An unhealthy resource holds a walk's gate for its module, so a delivery of a module with a directory - used as found waits until someone hands it over. That is intended: such a module may not be able to - write its data. + **The gate reads it as a wait for a person**, the way it reads a wait for a new login + ([ADR 0254](../../02-DECISIONS/0254-a-wait-for-a-persons-new-login-is-not-a-gates-failure-and-each-module-of-a-send-keeps-its-own-pass.md)). + - The node-engine keeps when it first found the directory (`found_at`) across applies. + - A directory found before the send being judged is no fault of that build. The module's gate passes, and + its verdict carries the wait: "uses … as found and waits for a person to hand it over". An urgent fix to + that module still reaches every machine. + - A directory found by that very send was brought by it, so the gate holds the module and, at its bound, + puts it back. - **`mesh-host`, the guard:** the same paths as the controller are added. The container runtime's data root - is read from its configuration. An account's `.ssh` is refused as an access or a mount, and as a + is read from its configuration: `data-root` in dockerd's `daemon.json`; `--data-root` (or the older `-g` and + `--graph`) on its unit's `ExecStart` and in the unit's drop-ins; and `graphroot` in podman's + `storage.conf`. `/var/lib/containerd` is refused as well. Two stores are not read. A containerd configured + elsewhere is not a runtime this mesh runs. Podman's rootless stores sit below each account's home, where + only that account's directories are placed anyway. An account's `.ssh` is refused as an access or a mount, and as a directory anywhere but below its own account's home. ### Step 3: what the live layers hold