jochen
c36677b9e5
Reading a file, searching one, listing a directory, the owner and mode of each component of a path and looking up an account went through the login shell's execute as the operator's account, which sees the operator's keys and the agent's credentials, and execute is not served on the control-node. This module holds node-reads on every node, runs as mesh-reads (no login, no group beside its own), refuses the node's secret places by name before any read (the controller's list and the known credential files), withholds any line shaped like a secret through mesh-sdk's outward rule, and bounds every answer.
55 lines
968 B
JSON
55 lines
968 B
JSON
{
|
|
"module": "mesh-reads",
|
|
"version": "1",
|
|
"runs-as": "mesh-reads",
|
|
"claims": [
|
|
{
|
|
"name": "node-reads",
|
|
"scope": "node",
|
|
"serves": [
|
|
"stat",
|
|
"readlink",
|
|
"list",
|
|
"read",
|
|
"search",
|
|
"account"
|
|
]
|
|
}
|
|
],
|
|
"own-secrets": {
|
|
"broker": "${dir:state}/broker"
|
|
},
|
|
"secrets-owner": "mesh-reads",
|
|
"resources": [
|
|
{
|
|
"id": "account",
|
|
"type": "user",
|
|
"name": "mesh-reads",
|
|
"shell": "/usr/bin/nologin",
|
|
"home": "/var/lib/mesh-reads"
|
|
},
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "mesh-reads",
|
|
"place": "."
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "tools",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/mesh-reads",
|
|
"binary": "mesh-reads",
|
|
"loads": [
|
|
"mesh-reads"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|