3 Commits

Include renames

Author	SHA1	Message	Date
jochen	b28d7bbcbf	Search for setuid programs in the background, and judge each polkit rule alone ... A search over a large disk ran inside the look, holding the judge's lock and stalling the health statement; it now runs apart, serving its last result, backing off after a failure, and saying not judged until it has one. And a rule naming a user, or a comment, no longer hides another rule's unconditional yes (hq ADR 0266).	2026-10-09 10:10:05 +02:00
jochen	3a727011ad	Judge whether an account declared never to become root can, so a machine's agents are known confined ... An account an agent runs as (novox/hq ADR 0266) is read on every look for a uid of 0, a group that grants root, any sudo rule and a mesh secret it can read; any way found is unhealthy and said, a read that fails is unknown.	2026-10-09 10:07:35 +02:00
jochen	ab4ca44f98	Give back only the groups the mesh added, and say when a new login is needed (hq ADR 0252, issue 247) ... A module puts the operator's account in a group by declaring the account with that group alone. The node-engine now records each group it added, takes back only those when nothing declared still asks for them, refuses a group the machine lacks before usermod runs, and states each such account as its module's resource of kind account: relogin needed while the running session lacks the group.	2026-10-08 12:04:08 +02:00