jochen
994cab533b
mesh/merge-gate pass: builds new: modules/mesh-reads, sent nowhere; no bus step; every machine composes with the change as it did without (4 of 4 compose)
mesh/repo-check pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-check-typescript.sh (typescript)
mesh/delivery delivered
Reading a file, searching one, listing a directory, the owner and mode of each component of a path and looking up an account went through the login shell's execute as the operator's account, which sees the operator's keys and the agent's credentials. This module holds node-reads on every node and runs as mesh-reads (no login, no group beside its own). It refuses the node's secret places by name, judging the file actually opened rather than the name asked, so a flipped link reaches nothing refused; withholds any line shaped like a secret through mesh-sdk's outward rule and every line of a BEGIN/END block; and bounds every answer. Replaces mesh-catalog #244 (reviews 55), whose first commit carried a built binary.
55 lines
968 B
JSON
55 lines
968 B
JSON
{
|
|
"module": "mesh-reads",
|
|
"version": "1",
|
|
"runs-as": "mesh-reads",
|
|
"claims": [
|
|
{
|
|
"name": "node-reads",
|
|
"scope": "node",
|
|
"serves": [
|
|
"stat",
|
|
"readlink",
|
|
"list",
|
|
"read",
|
|
"search",
|
|
"account"
|
|
]
|
|
}
|
|
],
|
|
"own-secrets": {
|
|
"broker": "${dir:state}/broker"
|
|
},
|
|
"secrets-owner": "mesh-reads",
|
|
"resources": [
|
|
{
|
|
"id": "account",
|
|
"type": "user",
|
|
"name": "mesh-reads",
|
|
"shell": "/usr/bin/nologin",
|
|
"home": "/var/lib/mesh-reads"
|
|
},
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"owner": "mesh-reads",
|
|
"place": "."
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "tools",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/mesh-reads",
|
|
"binary": "mesh-reads",
|
|
"loads": [
|
|
"mesh-reads"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|