admin
c17cfde236
internal/storage: mkfs executor (Format, device-pinned, narrow FELHOM_FORMAT sudoers) + data-bearing device inspection (InspectDevice/DeviceProbe via blkid+lsblk; conservative — ambiguous=data-bearing). internal/localapi: /disks (+ data-bearing flag), /disks/assign (EnsureMount), /disks/eject (Unmount + dependent guests), /disks/format. SECURITY CENTERPIECE: the agent inspects the device itself; data-bearing format -> ClassStorageWipe gate -> pending_signature refused; the caller's claim is never trusted. Additive (no controller change yet). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
51 lines
3.1 KiB
Plaintext
51 lines
3.1 KiB
Plaintext
# felhom-agent sudoers allowlist — the NARROW host-root surface (slice 5 Phase B, doc 03 §3/§7).
|
|
#
|
|
# Install as a drop-in: /etc/sudoers.d/felhom-agent (mode 0440, root:root), validated with
|
|
# `visudo -cf`. The agent runs as the non-root `felhom-agent` service user and shells out via
|
|
# `sudo -n` with FIXED argument vectors (no shell). The fine-grained validation is done IN
|
|
# the agent BEFORE exec (internal/storage/validate.go): UUIDs against a strict hex regex,
|
|
# mount paths confined+traversal-checked, SMART devices whitelisted to raw disks, LVM names
|
|
# charset-checked. These sudoers wildcards are the COARSE allowlist; the agent is the fine
|
|
# gate, so a wildcard can never be abused by a value the agent didn't already validate.
|
|
#
|
|
# Binary paths MUST match the agent config (privileged.systemctl/install/smartctl/lvs). Adjust
|
|
# for your distro (Debian/PVE shown). A missing/declined entry degrades the agent with a
|
|
# warning (SMART→UNKNOWN, mount→logged error), it does not crash.
|
|
|
|
Cmnd_Alias FELHOM_MOUNT = \
|
|
/usr/bin/install -o root -g root -m 0644 -- /var/lib/felhom-agent/units/* /etc/systemd/system/*.mount, \
|
|
/usr/bin/systemctl daemon-reload, \
|
|
/usr/bin/systemctl enable --now -- *.mount, \
|
|
/usr/bin/systemctl disable -- *.mount, \
|
|
/usr/bin/systemctl stop -- *.mount
|
|
|
|
Cmnd_Alias FELHOM_DISK = \
|
|
/usr/sbin/smartctl -a -j /dev/sd[a-z]*, \
|
|
/usr/sbin/smartctl -a -j /dev/nvme[0-9]*n[0-9]*, \
|
|
/usr/sbin/smartctl -a -j /dev/vd[a-z]*, \
|
|
/usr/sbin/smartctl -a -j /dev/hd[a-z]*, \
|
|
/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- *
|
|
|
|
# Provisioning back-half (slice 8A, doc 03 §6): populate a guest's bootstrap config mount
|
|
# host-side (internal/provision). These are host-root ops the API token cannot do — a bind mount
|
|
# is root@pam-only, and the chown maps the 0600 bootstrap.json to the unprivileged-LXC guest-root
|
|
# (uid/gid 100000, spike gotcha 1). The host dir is AGENT-OWNED state under /var/lib/felhom-agent/
|
|
# (the wildcard only ever names a path the agent itself created), and the bootstrap file the agent
|
|
# writes there is the only thing these touch. ':' is escaped per sudoers grammar.
|
|
Cmnd_Alias FELHOM_PROVISION = \
|
|
/usr/bin/chown -R 100000\:100000 /var/lib/felhom-agent/guests/*, \
|
|
/usr/sbin/pct set [0-9]* -mp[0-9]* /var/lib/felhom-agent/guests/*
|
|
|
|
# Disk inspection + format (slice 8C). blkid/lsblk read the device's data-bearing evidence (the
|
|
# agent decides data-bearing-ness from THIS, never the caller's claim); mkfs.* formats a device the
|
|
# agent already classified blank (a data-bearing format is refused pending an operator signature).
|
|
# The agent fine-validates the device path (ValidateBlockDevice: raw disk / partition under /dev
|
|
# only) + fstype before any exec — the wildcard is the coarse allowlist, the agent is the fine gate.
|
|
Cmnd_Alias FELHOM_FORMAT = \
|
|
/usr/sbin/blkid -p -o export /dev/*, \
|
|
/usr/bin/lsblk -J -o NAME,FSTYPE,PTTYPE,MOUNTPOINT /dev/*, \
|
|
/usr/sbin/mkfs.ext4 -F /dev/*, \
|
|
/usr/sbin/mkfs.xfs -f /dev/*
|
|
|
|
felhom-agent ALL=(root) NOPASSWD: FELHOM_MOUNT, FELHOM_DISK, FELHOM_PROVISION, FELHOM_FORMAT
|