jschoubben
b92fb68116
mesh/merge-gate pass: builds mesh-host → ace, g14, novox, shanks; no bus step; every machine composes with the change as it did without (4 of 4 compose)
mesh/repo-check pass: its merge-check.sh passed
mesh/delivery delivered
mesh/delivery-group group fix/358-judge-directories-read-only delivered: every member is delivered
Once a mesh directory's mode and owner go only through a walk that follows no link another account could make, a directory behind such a link is refused and its module gated: on the control-node that could stop the controller. The operator is to be told which directories that walk would refuse on every node before it lands. So the engine judges the declaration it keeps with the same walk, making and changing nothing: on a signed ask from the controller (mesh.node.<node>.ask.judge-directories, held to the hand-over's checks) and as `nox-mesh-host judge-directories` at the machine.
45 lines
1.5 KiB
Go
45 lines
1.5 KiB
Go
package main
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
|
|
"github.com/novox/mesh-host/internal/apply"
|
|
"github.com/novox/mesh-host/internal/declaration"
|
|
"github.com/novox/mesh-host/internal/link"
|
|
"github.com/novox/mesh-host/internal/store"
|
|
)
|
|
|
|
// judgeDirectories judges every directory of the declaration this node keeps, read-only (novox/hq issue 358): which
|
|
// the walk that follows no link another account could make would refuse. Nothing is made, chmodded or chowned.
|
|
func judgeDirectories(statePath string) (string, error) {
|
|
kept, err := store.ReadDeclared(store.DeclaredPath(statePath))
|
|
if errors.Is(err, store.ErrNothingDeclared) {
|
|
return "", errors.New("this node keeps no declaration, so it is declared no directory")
|
|
}
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
d, err := declaration.Parse(kept.Declaration)
|
|
if err != nil {
|
|
return "", fmt.Errorf("the declaration this node keeps does not read: %w", err)
|
|
}
|
|
return apply.JudgeDirectories(d), nil
|
|
}
|
|
|
|
// judgeDirectoriesFrom is judgeDirectories as the controller asks it over the link.
|
|
func judgeDirectoriesFrom(statePath string) link.JudgeDirectoriesFunc {
|
|
return func(string) (string, error) { return judgeDirectories(statePath) }
|
|
}
|
|
|
|
// judgeDirectoriesCommand is `nox-mesh-host judge-directories` at this machine, as root: the same judgement, for a
|
|
// machine the controller cannot ask.
|
|
func judgeDirectoriesCommand(opts options) error {
|
|
said, err := judgeDirectories(opts.state)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
fmt.Fprintln(opts.out, said)
|
|
return nil
|
|
}
|