Omar SobhandClaude Opus 4.7
d5651614ba
The v0.2.0 unit set ProtectHome=true to lock down /home from a
hypothetical RCE in axum. Side effect: ssh in peer_reachable
(serve.rs:145) failed with "Host key verification failed: Permission
denied" because ~/.ssh/known_hosts was unreachable. Adding
BindReadOnlyPaths=/home/osobh/.ssh didn't help — systemd applies
ProtectHome before the bind mounts run, so /home is already an
inaccessible barrier when the bind lands. Result: both dashboards
showed peer_reachable=false even though LAN ping + SSH worked fine
from a shell.
Two options to keep some sandboxing:
1. ProtectHome=tmpfs + BindReadOnlyPaths=/home/osobh/.ssh — bind
into an empty tmpfs view of /home.
2. Drop ProtectHome entirely — keep ProtectSystem=strict +
ReadWritePaths=/var/lib/claw-store + NoNewPrivileges + PrivateTmp.
Going with (2) for now. The threat model is local-host RCE in a
read-mostly axum service the dashboard pokes; ProtectSystem alone
prevents writing anywhere outside /var/lib/claw-store. Re-introduce
(1) when we have a clean justification.
Co-Authored-By: Claude Opus 4.7 <[email protected]>
34 lines
1.2 KiB
Desktop File
34 lines
1.2 KiB
Desktop File
[Unit]
|
|
# v0.2.0 — the HTTP+SSE API + React dashboard. Until now this ran as a
|
|
# hand-launched `claw-store serve` from a login shell — survived if the
|
|
# shell exited (orphaned to init), died on reboot. This unit makes the
|
|
# dashboard a first-class service that comes back the same way the
|
|
# daemon does.
|
|
Description=claw-store HTTP API + dashboard
|
|
After=network-online.target claw-store.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=osobh
|
|
ExecStart=/usr/local/bin/claw-store serve --port 7700 --static-dir /usr/share/claw-store/static
|
|
Restart=on-failure
|
|
RestartSec=15
|
|
Environment=RUST_LOG=info
|
|
|
|
# Dashboard is read-mostly + shells out to the local CLI for mutations
|
|
# AND probes the peer over SSH for /api/status's peer_reachable bit.
|
|
# Notes on the sandboxing:
|
|
# - ProtectHome was tried (with BindReadOnlyPaths=/home/osobh/.ssh)
|
|
# but systemd blocks ALL of /home before binds run; the ssh probe
|
|
# hits "Permission denied" on ~/.ssh/known_hosts even with the
|
|
# bind. Re-introduce via ProtectHome=tmpfs + an explicit bind if
|
|
# stronger sandboxing is needed later.
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/var/lib/claw-store
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|