quixos-toolchain/quixos-nix-helpers
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Qualify hosted development and compose service ownership

Browse Source
This commit is contained in:
Timothy J. Aveni
2026-10-11 13:53:36 -07:00
parent 6e591d5588
commit f67294f26d
4 changed files with 65 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
restricted-execution/identity-launcher.c
+4 -4
View File
@@ -20,17 +20,17 @@ static void fail(const char *message) {
}
int main(int argc, char **argv) {
const char *root = "/run/quixos-restricted-engines/";
const char *root = ENGINE_DIRECTORY "/";
uid_t caller = getuid();
gid_t group = getgid();
struct passwd *owner = getpwnam("quixos-graph");
struct passwd *owner = getpwnam(AUTHORITY_USER);
if (geteuid() != 0) fail("privileged wrapper unavailable");
if (!owner) fail("authority identity unavailable");
if (caller != owner->pw_uid) fail("caller identity mismatch");
if (argc != 3) fail("invalid arguments");
char *end;
unsigned long number = strtoul(argv[2], &end, 10);
if (!*argv[2] || *end || number < 610000 || number >= 610064)
if (!*argv[2] || *end || number < ENGINE_FIRST_UID || number >= ENGINE_FIRST_UID + ENGINE_IDENTITY_COUNT)
fail("invalid engine identity");
uid_t identity = (uid_t)number;
if (strlen(argv[1]) != strlen(root) + 16 || strncmp(argv[1], root, strlen(root)))
@@ -39,7 +39,7 @@ int main(int argc, char **argv) {
if (strncmp(name, "qx-engine-", 10) ||
strlen(name) != 16 || strspn(name + 10, "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789") != 6)
fail("invalid engine directory");
int parent = open("/run/quixos-restricted-engines", O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
int parent = open(ENGINE_DIRECTORY, O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
struct stat info;
if (parent < 0 || fstat(parent, &info) || info.st_uid != caller || (info.st_mode & 066))
fail("invalid engine root");