mesh-host

Files

T

jochen 5fc37b44a9

mesh/merge-gate pass: builds mesh-host → ace, g14, novox, shanks; no bus step; every machine composes with the change as it did without (4 of 4 compose)

Details

mesh/repo-check pass: its merge-check.sh passed

Details

mesh/delivery superseded: a newer head of the same pull request

Details

Follow no link below a home as root, and judge more ways to root

An account could replace ~/.claude with a link to /etc and have the
node-engine chown, chmod or write through it on the next apply. Below a
person's or an agent's home every component is now opened without
following a link, and a link refuses the resource in words.

The root judge also reads doas and polkit rules, the container runtimes'
sockets with their ACLs, ACLs on the secrets, and setuid-root programs no
package owns, in the C locale; Judged and NotJudged write down exactly
what it covers (hq ADR 0266 review).

2026-10-08 20:36:46 +02:00

accounts_test.go

Give back only the groups the mesh added, and say when a new login is needed (hq ADR 0252, issue 247)

2026-10-08 12:04:08 +02:00

accounts.go

Judge whether an account declared never to become root can, so a machine's agents are known confined

2026-10-08 18:30:10 +02:00

exec.go

Follow no link below a home as root, and judge more ways to root

2026-10-08 20:36:46 +02:00

root_test.go

Follow no link below a home as root, and judge more ways to root