manifoldco / manifoldco/torus-cli

User vs system configuration

Open
#60 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

help wanted
Dominant language
Go
Stars
603
Forks
30
PR merge metrics
No merged PRs in 30d

Description

Running torus system wide for machine usage is quite different than for a single user, as seen in #59

We need to enforce a different permission model.

For a user, everything should be accessible by that user *and only that user*. For a machine, the machine's token should be accessible only by root/the init process.

Logs should be viewable by system admins, and the torus socket/pid file should be accessible by some semi-trusted set of processes (ie a group).

This is mostly supported now, but configuring it is not ideal.

This issue will cover the changes we can make to make configuring torus as a system daemon for machine use nice and easy.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading issue #59 and the existing system-wide configuration, since the issue says most permission support already exists but is not easy to configure. Done means a system-daemon setup clearly enforces the stated token, log, socket, and pid-file access boundaries and is straightforward to configure.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
devops, operating-systems, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.