GameCult/Idunn
Watch
9
0
Fork
You've already forked Idunn
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Steward orders: one steward gate for fresh and recovered orders; the orders unit leaks no group or umask; root reads; kernel-attested issuer; end-to-end serve test

Browse source 
execute refuses, with a record and a post, an order whose principal or issuing
uid is not the steward bound now, before grammar, scope and brake; the brake
is asked for the bound principal only. idunn-orders.service drops Group= and
UMask=: bind_socket gives the socket to the steward uid at 0600 and serve sets
Idunn's own umask, so a deploy order writes control.cc 0640. Root may show and
list, never order. The issuer unit is the first unit under system.slice, never
a name the peer chose below it. Synapse waits for a reply within one deadline.
due_posts takes the deploy-state reader so a finished deploy's post is tested.
Tests: the gate both ways, root, per-order posts, deploy result, intake and
Synapse timeouts, parse_serve, user_uid, socket and store modes, and the whole
service as root with a fake systemctl, systemd-run and homeserver.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Meta Vens 2026-11-01 05:03:17 +01:00
commit 56edad95c1
2 changed files with 629 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

11
deploy/idunn-orders.service
View file

@ -15,10 +15,10 @@ Type=simple
# The unit name matches idunn-*, which is in the always-refused set, so no
# order can stop or restart this service.
User=root
# The socket is created root:idunn-steward 0660 (UMask below). The steward user
# is the only peer the service answers: it checks SO_PEERCRED on every
# connection, so the group is a second door held shut, not the lock.
Group=idunn-steward
# No Group= and no UMask=: the service gives its socket to the steward user
# (mode 0600) itself and sets Idunn's own umask for the files it writes, so
# nothing here reaches control.cc. The steward user is the only peer the
# service answers: it checks SO_PEERCRED on every connection.
ExecStart=/usr/local/bin/idunn orders serve \
--store /var/lib/gamecult/idunn-orders \
--state-store /var/lib/gamecult/idunn/control.cc \
@ -27,10 +27,9 @@ ExecStart=/usr/local/bin/idunn orders serve \
Restart=always
RestartSec=5
TimeoutStopSec=20
UMask=0117
RuntimeDirectory=idunn-orders
RuntimeDirectoryMode=0750
RuntimeDirectoryMode=0755
# The Synapse access token of @idunn, copied from a root-only file, and read
# through $CREDENTIALS_DIRECTORY; the service names it in steward.toml.