Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

standalone: carry pacman through local authority

Browse source 
Give a standalone Agent a durable identity and one signed pacman envelope path through the helper.

Every archive and detached signature crosses root custody before mutation. Fleet credentials still refuse the local minter.
This commit is contained in:
Fimeg 2026-09-01 14:12:39 -04:00
commit 7472d21c42
21 changed files with 2672 additions and 397 deletions
Download patch file Download diff file Expand all files Collapse all files

28
server/internal/services/templates/install/scripts/linux.sh.tmpl
View file

@ -307,8 +307,6 @@ case "$PM" in
# Disable lecture (first-time prompt) — agent runs as a service with no TTY
Defaults:{{.AgentUser}} !lecture
# Mutation — ONLY through the capability-token executor
{{.AgentUser}} ALL=(root) NOPASSWD: /usr/bin/systemd-run --wait --property=ProtectSystem=no -- /usr/local/bin/redflag-helper --token-file /var/lib/redflag/agent/tokens/* --result-file /var/lib/redflag/agent/results/*
EOF
;;
dnf|yum)
@ -320,21 +318,17 @@ EOF
# Disable lecture (first-time prompt) — agent runs as a service with no TTY
Defaults:{{.AgentUser}} !lecture
# Mutation — ONLY through the capability-token executor
{{.AgentUser}} ALL=(root) NOPASSWD: /usr/bin/systemd-run --wait --property=ProtectSystem=no -- /usr/local/bin/redflag-helper --token-file /var/lib/redflag/agent/tokens/* --result-file /var/lib/redflag/agent/results/*
EOF
;;
pacman)
cat <<'EOF' | sudo tee "$SUDOERS_FILE" > /dev/null
# RedFlag Agent minimal sudo permissions - Pacman
# Discovery — non-mutating (read-only)
{{.AgentUser}} ALL=(root) NOPASSWD: /usr/bin/pacman -Sy
# Discovery and closure resolution use an unprivileged private pacman database.
# The host sync database is never refreshed through sudo.
# Disable lecture (first-time prompt) — agent runs as a service with no TTY
Defaults:{{.AgentUser}} !lecture
# Mutation — ONLY through the capability-token executor
{{.AgentUser}} ALL=(root) NOPASSWD: /usr/bin/systemd-run --wait --property=ProtectSystem=no -- /usr/local/bin/redflag-helper --token-file /var/lib/redflag/agent/tokens/* --result-file /var/lib/redflag/agent/results/*
EOF
;;
*)
@ -346,17 +340,23 @@ EOF
# Disable lecture (first-time prompt) — agent runs as a service with no TTY
Defaults:{{.AgentUser}} !lecture
# Mutation — ONLY through the capability-token executor
{{.AgentUser}} ALL=(root) NOPASSWD: /usr/bin/systemd-run --wait --property=ProtectSystem=no -- /usr/local/bin/redflag-helper --token-file /var/lib/redflag/agent/tokens/* --result-file /var/lib/redflag/agent/results/*
EOF
;;
esac
# Fleet hosts receive capability-token execution only. Local mint and envelope
# authority are provisioned by
# scripts/provision-standalone-authority.sh and must never exist beside a fleet
# credential. Package-manager commands never appear in sudoers.
cat <<'EOF' | sudo tee -a "$SUDOERS_FILE" > /dev/null
{{.AgentUser}} ALL=(root) NOPASSWD: /usr/bin/systemd-run --wait --property=ProtectSystem=no -- /usr/local/bin/redflag-helper --token-file /var/lib/redflag/agent/tokens/* --result-file /var/lib/redflag/agent/results/*
EOF
# No Docker grants: the agent reaches the docker socket via the docker group
# (added above), so docker discovery/pull need no sudo.
# No self-update grants: the binary swap (cp/.bak/chmod/systemctl restart) is
# performed by the privileged helper under an agent-self capability token, not by
# the agent. The single systemd-run helper line above is the agent's only sudo.
# performed by the privileged helper under a signed capability, not by the
# agent. The fixed helper file protocol above is the agent's only sudo.
sudo chmod 440 "$SUDOERS_FILE"
if visudo -c -f "$SUDOERS_FILE" &>/dev/null; then
@ -366,12 +366,12 @@ else
fi
# Step 4b: Install polkit rule for transient unit management
# The agent's only sudo is `systemd-run --pipe ... redflag-helper`. systemd-run
# The agent's only sudo is a fixed `systemd-run ... redflag-helper` protocol. systemd-run
# spawns a transient unit over the system D-Bus, which polkit gates behind
# org.freedesktop.systemd1.manage-units (auth_admin). polkit evaluates the
# original caller ({{.AgentUser}}), so without this rule the helper invocation —
# and therefore every gated install and the agent self-update — is denied on a
# TTY-less service. The sudoers line above already pins the exact command; this
# TTY-less service. The sudoers line above pins the exact command shape; this
# grants the matching D-Bus permission to the same user, nothing wider.
POLKIT_RULES_DIR="/etc/polkit-1/rules.d"
POLKIT_RULE_FILE="${POLKIT_RULES_DIR}/50-redflag-agent.rules"