Fimeg/souveraine
Watch
1
0
Fork
You've already forked souveraine
 0
Code Releases Activity

admit: give an agent her own uid through one writer

Browse source 
souveraine-admit creates or adopts one account via systemd-sysusers, writes
the root-owned mapping health reads, and reports what NSS says afterwards
instead of what it asked for. An account belongs to one agent: handing
annie's to souvie is refused in both directions, as is adopting a uid >=1000.
Binding is by SeedID, not the UUID filename — a mismatch is identity-drift.
This commit is contained in:
Fimeg 2026-08-17 15:16:30 -04:00
commit 0f8fe22ab6
10 changed files with 745 additions and 170 deletions
Download patch file Download diff file Expand all files Collapse all files

9
.gitea/workflows/ci.yml
View file

@ -206,7 +206,8 @@ jobs:
# secrets rail + machined: also hand-copied on the phone until now.
./scripts/build-cross.sh --features secrets --bin souveraine-secrets
./scripts/build-cross.sh --bin souveraine-machined
for b in souveraine-secrets souveraine-machined; do
./scripts/build-cross.sh --bin souveraine-admit
for b in souveraine-secrets souveraine-machined souveraine-admit; do
B="$CARGO_TARGET_DIR/aarch64-unknown-linux-gnu/release/$b"
file "$B" | grep -q aarch64 || { echo "$b is not aarch64" >&2; exit 1; }
cp "$B" "$b-aarch64"
@ -220,7 +221,8 @@ jobs:
cargo build --release --features secrets --bin souveraine-secrets
cargo build --release --bin souveraine-machined
for b in souveraine-secrets souveraine-machined; do
cargo build --release --bin souveraine-admit
for b in souveraine-secrets souveraine-machined souveraine-admit; do
B="$CARGO_TARGET_DIR/release/$b"
file "$B" | grep -q 'x86-64' || { echo "$b is not x86_64" >&2; exit 1; }
cp "$B" "$b-x86_64"
@ -257,6 +259,7 @@ jobs:
souveraine-usb-kvm-aarch64 \
souveraine-secrets-aarch64 souveraine-secrets-x86_64 \
souveraine-machined-aarch64 souveraine-machined-x86_64 \
souveraine-admit-aarch64 souveraine-admit-x86_64 \
souveraine-sessiond-x86_64 souveraine-sensord-x86_64 \
> souveraine-binaries.sha256
@ -403,6 +406,7 @@ jobs:
cp "souveraine-$ARCH" "$PKG_WORK/souveraine-binary"
cp "souveraine-secrets-$ARCH" "$PKG_WORK/souveraine-secrets-binary"
cp "souveraine-machined-$ARCH" "$PKG_WORK/souveraine-machined-binary"
cp "souveraine-admit-$ARCH" "$PKG_WORK/souveraine-admit-binary"
cp "souveraine-sessiond-$ARCH" "$PKG_WORK/souveraine-sessiond-binary"
cp "souveraine-sensord-$ARCH" "$PKG_WORK/souveraine-sensord-binary"
cp packaging/souveraine.service packaging/souveraine-secrets.service \
@ -442,6 +446,7 @@ jobs:
bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine-sensord'
bsdtar -tf "$PKG" | grep -qx 'etc/pam.d/souveraine-sessiond'
bsdtar -tf "$PKG" | grep -qx 'usr/lib/sysusers.d/souveraine.conf'
bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine-admit'
if [ "$ARCH" = aarch64 ]; then
bsdtar -tf "$PKG" | grep -qx 'usr/bin/souveraine-usb-kvm'
fi