fix: grant Control scoped access to mesh state #57

Merged

ochenstarik-ui merged 8 commits from codex/mesh-state-permissions into main

2026-08-17 19:12:20 +00:00

ochenstarik-ui commented

2026-08-17 18:17:24 +00:00

(Migrated from github.com)

Summary

grant the Control service read/write access only to the shared mesh state directory
create and repair mesh/ as root:<control-user> mode 0770 and nodes.tsv as root:<control-user> mode 0660
keep WireGuard private material isolated as root:root under mode 0700/0600
cover clean installation, Control update, address reservation, and atomic node-state replacement
add a root-backed permission contract proving Control-equivalent access to nodes.tsv and denial for the Hub private key

Verification

Local:

git diff --check
static review of every nodes.tsv creation/replacement path
Windows-hosted Bash/WSL was not reliable enough for the privileged fixture, so the root permission test was validated on the GitHub Linux runner

Final CI against current main:

Not verified

no manual deployment on the owner's live three-server environment
no shared flock convention was added: the referenced Control-side implementation was closed and does not implement the same lock protocol, so a one-sided lock would provide false coordination

## Summary - grant the Control service read/write access only to the shared mesh state directory - create and repair `mesh/` as `root:<control-user>` mode `0770` and `nodes.tsv` as `root:<control-user>` mode `0660` - keep WireGuard private material isolated as `root:root` under mode `0700/0600` - cover clean installation, Control update, address reservation, and atomic node-state replacement - add a root-backed permission contract proving Control-equivalent access to `nodes.tsv` and denial for the Hub private key ## Verification Local: - `git diff --check` - static review of every `nodes.tsv` creation/replacement path - Windows-hosted Bash/WSL was not reliable enough for the privileged fixture, so the root permission test was validated on the GitHub Linux runner Final CI against current `main`: - [Linux control and agent](https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/32058187980) - [Linux platform matrix](https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/32058188088) - [Windows build](https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/32058188028) ## Not verified - no manual deployment on the owner's live three-server environment - no shared `flock` convention was added: the referenced Control-side implementation was closed and does not implement the same lock protocol, so a one-sided lock would provide false coordination