4 Commits

Include renames

Author	SHA1	Message	Date
jochen	bf3f45e769	A login session is the account's own, of class user, read at accept (hq ADR 0272) ... The cgroup names a scope; only logind's record of it says whose session it is. The engine now takes a session only when /run/systemd/sessions/<id> says it is this account's (UID), of class user (not a greeter's or the user manager's), and of this very scope. And it reads the session the moment the connection is accepted, with the namespaces, before the line, so the peer is judged as it was when it connected. Tests: session-9.scope with a user record is taken; x.scope, a different uid, another account's session, a greeter's, a record naming another scope, no record, and a path with dots are not; the session is read before the line is forwarded.	2026-10-09 13:55:45 +02:00
jochen	4a5dcb0209	Say the login session a mesh-cli line comes from, and pin the SDK at go/v0.1.9 (hq ADR 0272) ... A service running as the operator — the tool runner, a unit of the account's user manager — shares the operator's user id, and was as much the terminal on the control-node as a person typing. The engine now reads the asking process's cgroup and sends its login session's scope (session-<id>.scope under the account's own user-<uid>.slice), or nothing; the controller makes nothing else the terminal. The SDK is pinned at its tag now that go/v0.1.9 exists.	2026-10-09 13:40:17 +02:00
jochen	564948c2f2	mesh-cli: follow a line to its answer, bound each account, refuse other namespaces (review of hq ADR 0272) ... - A request that timed out was said as "the controller was not reached, nothing ran", though the line may have run. The engine now follows a line the controller answers as running, by its call, until it ends; when no answer comes in time it says the line may have run and names the call. "Nothing ran" is said only of a request no controller took. - One account could hold the socket: accepting waited for a free slot, and a connection could stall before its deadline was set. The deadline is set at accept, before any lookup; each user id has two lines at once and the machine eight, and one over is answered busy at once. - A container running with the operator's user id shares the number, not the machine: a peer whose mount or user namespace is not the engine's is refused, and nothing is asked. SDK pinned at the go/cli branch's newest commit until go/v0.1.9 is tagged.	2026-10-09 12:48:20 +02:00
jochen	021d860ca4	Vouch for the account that runs mesh-cli, and ask the controller its line (hq ADR 0272) ... The records send the operator to "the controller's terminal", and nothing reaches it (hq issue 343). mesh-cli holds no credential: it asks the engine on its own machine over a socket. The engine reads the asking account from the kernel (SO_PEERCRED), never from the program, and asks the controller on mesh.control.<node>.cli, its own node's subject, so the bus server says which node asked. The controller decides what the line may do; nothing received on the socket is run or applied here, and the socket has no network address (ADR 0004 stands). The local protocol is the SDK's go/cli package, at a pseudo-version of its branch until that merges and is tagged go/v0.1.8.	2026-10-09 12:05:53 +02:00