jochen
805bf1765a
mesh/merge-gate fail: builds claude-code, claude-licence-manager, restic, sudo → ace, g14, novox, shanks; no bus step; 4 problem(s) the change brings; the …
mesh/repo-check pass: THE CHANGE ALTERS ITS OWN CHECK (merge-check.sh): main's version judged it; the change's judges the pull requests after it merges; it…
mesh/delivery superseded: a newer head of the same pull request
The node-engine writes those as root after checking the path, and the agent account owns its home and could swap a link in between (hq ADR 0266). No module does it today; this keeps a future one from opening the gap.
92 lines
2.8 KiB
Go
92 lines
2.8 KiB
Go
// Command agenthome refuses, in every module's manifest, a resource placed under the agent account's home
|
|
// that the node-engine cannot write without a gap (novox/hq ADR 0266).
|
|
//
|
|
// The agent account owns its home and everything in it, so it can put a symbolic or hard link anywhere
|
|
// there. The node-engine, as root, writes a whole file or a directory below a home through descriptors it
|
|
// opened itself and refuses a link it finds; it unpacks an archive, and writes into an existing file (`into`:
|
|
// json or block), only after checking the path, so a link swapped in between the check and the write would
|
|
// point root's write at any file. No module does either today. This check keeps it so: a resource of type
|
|
// `archive`, or a `file` with `into`, whose path is under ${machine:agent-home}, is refused.
|
|
//
|
|
// go run . <catalogue root>
|
|
//
|
|
// Exits 1 on a finding.
|
|
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"sort"
|
|
"strings"
|
|
)
|
|
|
|
// AgentHome is the machine fact naming the agent account's home.
|
|
const AgentHome = "${machine:agent-home}"
|
|
|
|
// Finding is one resource refused.
|
|
type Finding struct {
|
|
Module, ID, Why string
|
|
}
|
|
|
|
// Check reads every manifest under root/modules and answers what it refuses.
|
|
func Check(root string) ([]Finding, error) {
|
|
manifests, err := filepath.Glob(filepath.Join(root, "modules", "*", "module.json"))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
sort.Strings(manifests)
|
|
var out []Finding
|
|
for _, path := range manifests {
|
|
raw, err := os.ReadFile(path)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var m struct {
|
|
Module string `json:"module"`
|
|
Resources []map[string]any `json:"resources"`
|
|
}
|
|
if err := json.Unmarshal(raw, &m); err != nil {
|
|
return nil, fmt.Errorf("%s: %w", path, err)
|
|
}
|
|
for _, r := range m.Resources {
|
|
p, _ := r["path"].(string)
|
|
if !strings.HasPrefix(p, AgentHome) {
|
|
continue
|
|
}
|
|
id, _ := r["id"].(string)
|
|
kind, _ := r["type"].(string)
|
|
into, _ := r["into"].(string)
|
|
switch {
|
|
case kind == "archive":
|
|
out = append(out, Finding{m.Module, id, "an archive unpacked under the agent's home"})
|
|
case kind == "file" && into != "":
|
|
out = append(out, Finding{m.Module, id, "a file written into (" + into + ") under the agent's home"})
|
|
}
|
|
}
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
func main() {
|
|
root := "."
|
|
if len(os.Args) > 1 {
|
|
root = os.Args[1]
|
|
}
|
|
found, err := Check(root)
|
|
if err != nil {
|
|
fmt.Fprintln(os.Stderr, err)
|
|
os.Exit(1)
|
|
}
|
|
for _, f := range found {
|
|
fmt.Printf("%s: %s is %s: the node-engine writes it as root after checking the path, and the agent "+
|
|
"account could swap a link in between (novox/hq ADR 0266); place a whole file or a directory instead\n",
|
|
f.Module, f.ID, f.Why)
|
|
}
|
|
if len(found) > 0 {
|
|
os.Exit(1)
|
|
}
|
|
fmt.Println("agent-home: no archive and no file written into under the agent's home")
|
|
}
|