admin
9d6e49236c
The privileged write surface, isolated behind a narrow, arg-validated, adversarially- tested seam (HostOps), the same discipline as the slice-4 gate. Completes slice 5. - internal/storage: HostOps seam + SudoHostOps (systemd .mount units by fs-UUID, detach, SMART, lvs) via sudoers allowlist + fixed arg vectors, no shell; NoopHostOps fallback. - validate.go: strict UUID/mount-path/device/LVM validators + in-process systemd-escape. Headline test: adversarial matrix (metacharacters/traversal/malformed) refused with zero exec. - smart.go: smartctl SATA + NVMe parse, UNKNOWN-degrade; lvs thin-pool metadata fill. - observer enrichment (Observe only): fills smart + thin-pool metadata. - watchdog: benign re-mount response off the poll path (DevicePresent probe, rate-limited). - reconcile: ActionResize (benign, grow-only) + proxmox.ResizeLXC; destructive storage ops (ClassStorageWipe/Decommission) through the slice-4 gate, target-scoped; built+tested, inert live. - --selftest=storage [-watch] live harness; configs/felhom-agent.sudoers; privileged.* knobs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
30 lines
1.6 KiB
Plaintext
30 lines
1.6 KiB
Plaintext
# felhom-agent sudoers allowlist — the NARROW host-root surface (slice 5 Phase B, doc 03 §3/§7).
|
|
#
|
|
# Install as a drop-in: /etc/sudoers.d/felhom-agent (mode 0440, root:root), validated with
|
|
# `visudo -cf`. The agent runs as the non-root `felhom-agent` service user and shells out via
|
|
# `sudo -n` with FIXED argument vectors (no shell). The fine-grained validation is done IN
|
|
# the agent BEFORE exec (internal/storage/validate.go): UUIDs against a strict hex regex,
|
|
# mount paths confined+traversal-checked, SMART devices whitelisted to raw disks, LVM names
|
|
# charset-checked. These sudoers wildcards are the COARSE allowlist; the agent is the fine
|
|
# gate, so a wildcard can never be abused by a value the agent didn't already validate.
|
|
#
|
|
# Binary paths MUST match the agent config (privileged.systemctl/install/smartctl/lvs). Adjust
|
|
# for your distro (Debian/PVE shown). A missing/declined entry degrades the agent with a
|
|
# warning (SMART→UNKNOWN, mount→logged error), it does not crash.
|
|
|
|
Cmnd_Alias FELHOM_MOUNT = \
|
|
/usr/bin/install -o root -g root -m 0644 -- /var/lib/felhom-agent/units/* /etc/systemd/system/*.mount, \
|
|
/usr/bin/systemctl daemon-reload, \
|
|
/usr/bin/systemctl enable --now -- *.mount, \
|
|
/usr/bin/systemctl disable -- *.mount, \
|
|
/usr/bin/systemctl stop -- *.mount
|
|
|
|
Cmnd_Alias FELHOM_DISK = \
|
|
/usr/sbin/smartctl -a -j /dev/sd[a-z]*, \
|
|
/usr/sbin/smartctl -a -j /dev/nvme[0-9]*n[0-9]*, \
|
|
/usr/sbin/smartctl -a -j /dev/vd[a-z]*, \
|
|
/usr/sbin/smartctl -a -j /dev/hd[a-z]*, \
|
|
/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- *
|
|
|
|
felhom-agent ALL=(root) NOPASSWD: FELHOM_MOUNT, FELHOM_DISK
|