Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

docs: bind the supply-chain claims to the helper

Browse source
This commit is contained in:
Fimeg 2026-08-25 08:26:05 -04:00
commit c3037655cd
10 changed files with 194 additions and 128 deletions
Download patch file Download diff file Expand all files Collapse all files

6
RAF/components/06-session-broker.md
View file

@ -15,7 +15,7 @@ The existing architecture has three artifacts with clean boundaries. Tier 4 adds
| Component | Network | Lifetime | Privilege | Purpose |
|-----------|---------|----------|-----------|---------|
| Agent (Go) | None (pull-only) | Persistent daemon | Unprivileged | Poll, scan, process tokens |
| Helper (Rust) | None | One-shot | Privileged (systemd-run) | Verify + execute one mutation |
| Helper (Rust) | Host network currently reachable; isolation intended | One-shot | Privileged (systemd-run) | Verify authority + execute one mutation |
| Desktop (Rust/Tauri) | None (local socket only) | Persistent | Unprivileged | Local tray status |
| **Broker (Rust)** | WebSocket to server | Per-session | Privileged (systemd-run) | Grant verification, session lifecycle, audit trail |
| **Streamer (Rust)** | WebRTC/WS to browser, ENet to Sunshine | Per-session | Privileged (systemd-run) | Moonlight protocol, video decode, input injection |
@ -30,7 +30,7 @@ The broker and streamer are **separate binaries** by design:
Tier 4 needs a live interactive channel — streaming I/O, return data, a WebSocket or gRPC connection to the server. None of the existing components can carry this without breaking their design constraints:
- **Agent:** pull-only doctrine forbids server-initiated connections; grafting a push channel onto the agent would destroy the posture that makes it safe.
- **Helper:** network-less by design; one-shot by design. A persistent session is the opposite of both.
- **Helper:** one-shot by design. Network isolation is also the target, but the current helper unit does not enforce it; a persistent interactive channel would still violate the intended boundary.
- **Desktop:** local-only by design; no server connectivity.
The session broker is the fifth artifact. It reuses the agent's spawn pattern (`sudo systemd-run --pipe`) but has its own trust boundary, its own network connection, and its own audit trail.
@ -154,7 +154,7 @@ Same pattern as the helper, same narrowed sudoers philosophy: the agent can spaw
### `ProtectSystem=no` blast radius
The broker unit is the most-privileged transient thing on the host: root, full filesystem access, network connection. This is a wider blast radius than the helper (which is also root + `ProtectSystem=no` but has no network). The tighter gating compensates:
The broker unit is the most-privileged transient thing on the host: root, full filesystem access, a network connection, and an interactive lifetime. The current helper unit is also root with `ProtectSystem=no` and retains host network access; that is a helper gap, not a safety property the broker design may rely on. The broker's interactive protocol surface and longer lifetime still make its blast radius wider. The tighter gating compensates:
- Grant is short-lived (15 min max recommended TTL)
- Grant is scoped to one operator, one agent, one scope