feat(dedicated-server): support multiple agent users on one box - #219
Merged
Conversation
The first provisioning run hardcoded a single agent user, which would have left the second and third silently unprotected. The dangerous one was the nftables fence: it matched `meta skuid 1001` literally, and the drop-and-log rule lives in a chain only that uid ever jumps into. A second agent user would therefore have had NO egress restriction and raised NO alarm -- an unfenced agent would look exactly like a quiet one. The auditd rules and the divergence tripwire were merely path-hardcoded. Introduces /etc/recode-agents.conf as the registry (one `user:repo` line per agent) and drives everything from it: - nftables now matches an `agent_uids` SET rather than a literal uid. - divergence-check.sh becomes posture-check.sh: it iterates the registry for git divergence AND cross-checks that every registered agent's uid is present in the live nftables set, paging when they disagree. - gen-audit-rules.sh regenerates the auditd watch list from the registry, replacing the hand-written single-user rules file. The nftables set is deliberately NOT generated from the registry. A generator that fails leaves the set empty, and an empty set means no agent is fenced -- fail-open, silently, for the one component where that is least acceptable. The set is edited by hand and posture-check.sh makes forgetting noisy instead. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
robercano-ghbot
added
the
needs-human
Collaborator
|
feat(dedicated-server): support multiple agent users on one box (not yet reviewed) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prep for provisioning a second and third agent user (reDeploy, reDeFi) on the box from #212/#213.
The bug this prevents
The nftables fence matched
meta skuid 1001literally, and the drop-and-log rule sits in a chain only that uid ever jumps into. A second agent user would have had no egress restriction and no alarm — an unfenced agent indistinguishable from a quiet one, which is exactly the failure mode this layer exists to prevent.The auditd rules and divergence tripwire were merely path-hardcoded — annoying rather than dangerous.
What changes
/etc/recode-agents.confbecomes the registry (oneuser:repoline per agent), and everything reads it:agent_uidsset instead of a literal uidposture-check.sh(wasdivergence-check.sh) iterates the registry for git divergence and cross-checks every registered uid against the live nftables set, paging when they disagreegen-audit-rules.shregenerates the auditd watch list from the registryOne deliberate non-automation
The nftables set is not generated from the registry. A generator that fails leaves the set empty — and empty means no agent is fenced, silently, for the one component where fail-open is least acceptable. So the set is hand-edited, and
posture-check.shmakes forgetting noisy instead of invisible.Not verified on a live box
type uidset syntax parsed correctly undernft -cbut couldn't be applied without root, and there is no second agent user yet to exercise the multi-agent path. Runsudo nft -c -fbefore restarting the unit, and confirm withnft list set inet recode_agent agent_uidsafterwards.🤖 Generated with Claude Code