4 Commits

Include renames

Author	SHA1	Message	Date
jochen	9a807de659	Give a handed-over directory through no link on every apply, not only the first (hq issue 356, review) ... After the first apply the record is no longer used as found, so the directory read as the mesh's own and later applies set its mode and owner by path: a parent swapped for a link after the hand-over took carried root's chmod and chown to its target. The hand-over is now checked before that shortcut, so a handed-over directory always goes through applyHandedOver. The test swaps the parent and the grandparent after an apply already gave the directory its mode; both cases fail with the old order.	2026-10-09 19:58:27 +02:00
jochen	fc6c5a92e6	Believe a hand-over only signed by the mesh, and give it through no link (hq issue 356, review) ... Two holes the review proved. The ask's subject proved nothing — a responder can reach it through a reply — so the engine now verifies the mesh's signature over a fixed context with the key it verifies declarations with, before reading anything, and refuses an ask for another node, expired, good too long, without a nonce, or replayed. And the apply followed a link the hand-over had refused: a component swapped for a link after the record carried root's chmod and chown to its target. A handed-over directory must now still resolve to itself, and is changed only through one descriptor opened from / with no link followed (fchmod, fchown). Tests for the reply guard, the run loop's hook, the fallback renewal on proof and a non-regular fallback; 27 checks each removed in turn, each failing a test.	2026-10-09 19:45:00 +02:00
jochen	ae1293e73e	Read every runtime's data root, keep when a directory was found, and key a hand-over to its resource ... The review of #64 asked for containerd's tree, dockerd's --data-root from its unit and drop-ins, and podman's graphroot to be refused like docker's own (hq issue 339); and the controller now tells a directory a send found from one found before it, which needs the time it was first found kept across applies instead of the time of the last apply. A hand-over now names the resource it was for, so it lapses if another declaration points at the path.	2026-10-09 00:55:21 +02:00
jochen	07164e40f3	Say every directory used as found, let a person hand it over, and refuse the runtime's data and any .ssh ... A directory the engine used as found kept its owner and mode in silence, so a module that cannot write it would just fail (hq issue 339 review). Each one is now a WARNING in every apply's log and its module's resource of kind directory, stated unhealthy on every look with its owner and what was declared, which the controller raises as the module's condition; `mesh-host hand-over <dir>` at the machine hands it to the mesh, and the next apply gives it the declared owner and mode. The guard also refuses the spool, /opt, the container runtimes' data (its configured data-root too), and an account's .ssh as an access, a mount, or a directory anywhere but its own home.	2026-10-09 00:28:01 +02:00