novox/mesh-controller
6
0
Fork 0
Code Issues Pull Requests 4 Releases Wiki Activity

Refuse a module of its own account running as the node's operator or agent account (hq ADR 0259 §8, review L4)

Browse Source
This commit is contained in:
jschoubben
2026-10-09 13:48:56 +02:00
parent 5fa8e40667
commit e2a45b18ba
2 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/catalogue/runtime.go
+10
View File
@@ -266,6 +266,16 @@ func (r Resolution) ownRuntimes(with Rendering) ([]map[string]any, error) {
program := runtime.Bundles[0]
var out []map[string]any
for _, m := range own {
// Never the node's operator account, nor the account agents run as there (the review of 2026-10-09):
// either would hand what it holds back to the very accounts it is kept from.
switch {
case r.Account != "" && m.RunsAs == r.Account:
return nil, fmt.Errorf("%s runs as %s, the operator's account on %s: a module of its own account never "+
"runs as it (novox/hq ADR 0259 §8)", m.Module, m.RunsAs, r.Node)
case r.AgentAccount != "" && m.RunsAs == r.AgentAccount:
return nil, fmt.Errorf("%s runs as %s, the account agents run as on %s: a module of its own account "+
"never runs as it (novox/hq ADR 0259 §8)", m.Module, m.RunsAs, r.Node)
}
credential, declared := m.OwnSecrets["broker"]
if !declared {
return nil, fmt.Errorf("%s runs as its own account and declares no own secret broker", m.Module)