jochen
c36677b9e5
Reading a file, searching one, listing a directory, the owner and mode of each component of a path and looking up an account went through the login shell's execute as the operator's account, which sees the operator's keys and the agent's credentials, and execute is not served on the control-node. This module holds node-reads on every node, runs as mesh-reads (no login, no group beside its own), refuses the node's secret places by name before any read (the controller's list and the known credential files), withholds any line shaped like a secret through mesh-sdk's outward rule, and bounds every answer.
3.2 KiB
mesh-reads
A node's files and accounts, read through the mesh (novox/hq ADR 0310, extending ADR 0268 §5; hq to-be 41
WP8; issue 418). It holds the node seat node-reads on every node, the control-node included, so reading a
file, searching one, listing a directory, the owner and mode of each component of a path and looking up an
account or a group never go through the login shell's execute, and an approval is asked for an act, never
for a read.
Who it reads as
The account mesh-reads, which this module makes on every node (runs-as, ADR 0259 §8): no login shell, a
home of its own under /var/lib, and no group beside its own. The tool runner serves it in a runtime of its
own, on its own bus credential, never the machine's runtime, which runs as the operator's account. So the
node's file modes bound what it sees: a file only the operator, root or a module's own account may read is
refused by its mode, and the answer says so. It refuses every read when it finds itself running as root.
What it refuses by name
Before any read, whatever the file modes would allow (ADR 0310 §5):
- The places the mesh keeps a secret on this node, which the controller composes from the manifests
and gives it as
MESH_SECRET_PLACES: the directory of every module's own secret (its bus credential among them), every credential file and grant directory, the vault's directories, and where the operator-sealed secrets are kept. Without that list the module does not start. - The known credential files of a machine's programs (
refuse.go): an account's.ssh,.gnupg,.aws,.kube; the agent's.credentials.json,.netrc,.pgpass,.git-credentials; private key names (id_ed25519,*.key,ssh_host_*_key);/etc/shadow;/etc/ssl/private,/etc/wireguardand the network manager's connections.
A link is judged by where it leads as well as by its name. stat and readlink say a secret place's owner
and mode, and mark it, because those are not its content; list, read and search refuse it.
The content rule
Every answer passes the content rule's secret class, from mesh-sdk's outward package (ADR 0310 §4): a
line of a file or a matching line shaped like a secret is withheld and its number said, as is a link target
or an account's words. A path and an entry's name are not judged: they are what the caller named or what the
file system calls a thing, and the rule would take a temporary directory's or a container layer's name for a
token.
Its verbs and their bounds
| verb | replaces | bounds |
|---|---|---|
stat |
stat, ls -ld, namei -l, findmnt -T |
200 paths, 64 components each; links followed only with follow |
readlink |
readlink, readlink -f, realpath |
one path |
list |
ls, ls -la |
2000 entries, cut and said |
read |
cat, head, tail, less |
64 KiB, or up to 256 KiB when asked; cut at a line and said; text only |
search |
grep, grep -r, grep -F |
a fixed string; 100 matches (500 asked), 4 deep (8 asked), 5000 files, 4 MiB a file, 20 seconds; the bound met is said |
account |
getent passwd, getent group, id, groups |
2000 accounts and groups; never a password field |
No answer is larger than 1 MiB. Nothing here writes a file.