Fimeg/souveraine
Watch
1
0
Fork
You've already forked souveraine
 0
Code Releases Activity

admit: give an agent her own uid through one writer

Browse source 
souveraine-admit creates or adopts one account via systemd-sysusers, writes
the root-owned mapping health reads, and reports what NSS says afterwards
instead of what it asked for. An account belongs to one agent: handing
annie's to souvie is refused in both directions, as is adopting a uid >=1000.
Binding is by SeedID, not the UUID filename — a mismatch is identity-drift.
This commit is contained in:
Fimeg 2026-08-17 15:16:30 -04:00
commit 0f8fe22ab6
10 changed files with 745 additions and 170 deletions
Download patch file Download diff file Expand all files Collapse all files

1
packaging/arch/PKGBUILD
View file

@ -38,6 +38,7 @@ package() {
# System tier: machine identity daemon + its service user. pacman runs
# systemd-sysusers on install, so the `souveraine` user exists before
# anyone runs `souveraine machine init`.
install -Dm755 target/release/souveraine-admit "$pkgdir/usr/bin/souveraine-admit"
install -Dm755 target/release/souveraine-machined "$pkgdir/usr/bin/souveraine-machined"
install -Dm644 packaging/souveraine-machined.service \
"$pkgdir/usr/lib/systemd/system/souveraine-machined.service"

6
packaging/arch/PKGBUILD.prebuilt
View file

@ -16,6 +16,7 @@ backup=('etc/pam.d/souveraine-stepup' 'etc/pam.d/souveraine-sessiond')
source=('souveraine-binary' 'souveraine.service'
'souveraine-secrets-binary' 'souveraine-secrets.service'
'souveraine-machined-binary' 'souveraine-machined.service'
'souveraine-admit-binary'
'souveraine.sysusers'
'souveraine-sessiond-binary' 'souveraine-sessiond.service'
'souveraine-sensord-binary' 'souveraine-sensord.service'
@ -24,7 +25,7 @@ source=('souveraine-binary' 'souveraine.service'
'souveraine-stepup.pam' 'org.souveraine.stepup.policy'
'LICENSE')
sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP'
'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
# sessiond is built and packaged for both supported architectures. Installing
# its user unit does not enable or start it; activation remains target-owned.
if [ "$CARCH" = aarch64 ]; then
@ -94,6 +95,9 @@ package() {
# souveraine-secrets.service already owns the bus name at runtime, so the
# rail works without stealing the D-Bus activation file.
# The admission executor. Root-only in use, so it ships 0755 and refuses
# itself rather than carrying setuid.
install -Dm755 "$srcdir/souveraine-admit-binary" "$pkgdir/usr/bin/souveraine-admit"
install -Dm755 "$srcdir/souveraine-machined-binary" "$pkgdir/usr/bin/souveraine-machined"
install -Dm644 "$srcdir/souveraine-machined.service" \
"$pkgdir/usr/lib/systemd/system/souveraine-machined.service"