Fimeg/souveraine
Watch
1
0
Fork
You've already forked souveraine
 0
Code Releases Activity

admit: give an agent her own uid through one writer

Browse source 
souveraine-admit creates or adopts one account via systemd-sysusers, writes
the root-owned mapping health reads, and reports what NSS says afterwards
instead of what it asked for. An account belongs to one agent: handing
annie's to souvie is refused in both directions, as is adopting a uid >=1000.
Binding is by SeedID, not the UUID filename — a mismatch is identity-drift.
This commit is contained in:
Fimeg 2026-08-17 15:16:30 -04:00
commit 0f8fe22ab6
10 changed files with 745 additions and 170 deletions
Download patch file Download diff file Expand all files Collapse all files

6
packaging/arch/PKGBUILD.prebuilt
View file

@ -16,6 +16,7 @@ backup=('etc/pam.d/souveraine-stepup' 'etc/pam.d/souveraine-sessiond')
source=('souveraine-binary' 'souveraine.service'
'souveraine-secrets-binary' 'souveraine-secrets.service'
'souveraine-machined-binary' 'souveraine-machined.service'
'souveraine-admit-binary'
'souveraine.sysusers'
'souveraine-sessiond-binary' 'souveraine-sessiond.service'
'souveraine-sensord-binary' 'souveraine-sensord.service'
@ -24,7 +25,7 @@ source=('souveraine-binary' 'souveraine.service'
'souveraine-stepup.pam' 'org.souveraine.stepup.policy'
'LICENSE')
sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP'
'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
# sessiond is built and packaged for both supported architectures. Installing
# its user unit does not enable or start it; activation remains target-owned.
if [ "$CARCH" = aarch64 ]; then
@ -94,6 +95,9 @@ package() {
# souveraine-secrets.service already owns the bus name at runtime, so the
# rail works without stealing the D-Bus activation file.
# The admission executor. Root-only in use, so it ships 0755 and refuses
# itself rather than carrying setuid.
install -Dm755 "$srcdir/souveraine-admit-binary" "$pkgdir/usr/bin/souveraine-admit"
install -Dm755 "$srcdir/souveraine-machined-binary" "$pkgdir/usr/bin/souveraine-machined"
install -Dm644 "$srcdir/souveraine-machined.service" \
"$pkgdir/usr/lib/systemd/system/souveraine-machined.service"