mesh-adminandClaude Opus 5.5
eb2ec23679
The provisioner's client (ADR 0349 §4) fills a module's templates and needs the node-engine to write them: it must not hold the right to write the machine's files itself. A second local socket accepts a write only from the account the declaration names as the provisioner client's (SO_PEERCRED, same namespaces), only for a clean path the declaration names as filled, under the apply's own locks, and writes it through the apply as the declared file would be, firing restart-on, reload-on and container reads. Issue 668. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
20 lines
1016 B
Go
20 lines
1016 B
Go
package meshcli
|
|
|
|
import "net"
|
|
|
|
// The kernel's word on who is at the other end of a socket, shared with the node-engine's other local socket, the
|
|
// write of a filled file (internal/filling, novox/hq ADR 0349 §4): one reading of it, so the two never judge a peer
|
|
// differently.
|
|
|
|
// PeerCredentials is the user id and process id of the process at the other end, as the kernel recorded them when
|
|
// it connected (SO_PEERCRED). Nothing the process says is read.
|
|
func PeerCredentials(conn *net.UnixConn) (uint32, int32, error) { return peerCredentials(conn) }
|
|
|
|
// SameNamespaces refuses a process whose mount or user namespace is not the engine's: a user id is this machine's
|
|
// account only in this machine's namespaces.
|
|
func SameNamespaces(pid int32) error { return namespacesOf(pid) }
|
|
|
|
// NotOwnDirectory says what is wrong with a socket's directory, or nothing: it must be a directory, not a link,
|
|
// owned by the account the engine runs as.
|
|
func NotOwnDirectory(dir string) string { return notOwnDirectory(dir) }
|