From cc97ff9eaa9f865a66000a308a373c4d4895c37c Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sun, 6 Sep 2026 19:54:49 +0200 Subject: [PATCH] Record the parent-only descriptor requirement The runtime presence identity is handed to the workload as an inherited file descriptor, so Idunn requires the source file to be root-owned, mode 0400, and singly linked. Enrolment leaves it 0600, which fails. The nlink check is the interesting one: a second hard link would be a second path to the signing key, and a descriptor that cannot be reopened is the whole point of passing it this way. Co-Authored-By: Claude Opus 5 --- docs/migration.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/migration.md b/docs/migration.md index 4913eb5..bc23545 100644 --- a/docs/migration.md +++ b/docs/migration.md @@ -393,6 +393,7 @@ binding cannot widen access, and each one cost a failed deployment to discover: | `cache_root` parent | root-owned, not group- or world-writable | `/srv/build` is `idunn:idunn` and therefore fails; put caches under Idunn.s own root | | frozen source stage | root-owned, non-writable | source is frozen *as* `idunn`, then copied into a root-owned actuation stage | | runner network | must exist | the binding names a docker network; the operator provisions it | +| runtime presence identity | `root:root`, mode `0400`, `nlink` 1 | passed to the workload as a parent-only descriptor, so it must be unwritable and unaliased -- a second hard link would be a second path to the signing key | **The Idunn unit also needs the target.s roots.** `ProtectSystem=full` makes `/etc` read-only, so a target whose `runtime_root` is not in `ReadWritePaths`