Aleksandr Bogomiakov
ac5a1596ef
When running the tsunagi agent as an elevated Administrator or Windows Service, unprivileged user-space processes (such as a system tray application, user-level CLI commands, or status monitors) could not interact with the control socket. This was due to two constraints on Windows: 1. The default control socket path was derived from the per-user %APPDATA%, making an administrator's socket invisible or inaccessible to a non-elevated standard user profile. 2. Even if pointed to the same named pipe, Windows Mandatory Integrity Control (MIC) and default ACLs prevent a Medium-Integrity (unelevated) process from opening a High-Integrity (elevated) pipe server for write access unless explicitly allowed. Key changes: - In crates/tsunagi/src/ipc/windows.rs, implement PipeSecurityAttributes using Win32 ConvertStringSecurityDescriptorToSecurityDescriptorW with SDDL: "D:(A;;GRGW;;;WD)(A;;GA;;;BA)(A;;GA;;;SY)S:(ML;;NW;;;ME)". This grants generic read/write access to Everyone (WD), retains full control for Administrators (BA) and LocalSystem (SY), and sets the Mandatory Label SACL to Medium Integrity (ME) with No-Write-Up (NW). - In crates/tsunagi/src/ipc/mod.rs, introduce default_control_socket_path() which points to %ProgramData%\tsunagi\agent.sock on Windows (and default per-user state directory on Unix). - In crates/tsunagi-cli/src/main.rs, support TSUNAGI_CONTROL_SOCKET environment variable across all commands, and use default_control_socket_path() on Windows when running against the default state directory. Custom state directories (--state-dir) or explicit sockets (--control-socket) continue to take precedence, allowing multi-daemon setups to remain strictly isolated. - In workspace Cargo.toml, set unsafe_code = "deny" so the workspace forbids unsafe code while permitting explicit, documented unsafe Win32 API calls in windows.rs. Validation on Linux: - cargo fmt --all -- --check passed. - cargo clippy --locked --workspace --all-targets -- -D warnings passed. - cargo test --locked --workspace --all-targets --jobs 2 -- --test-threads=2 passed (349 tests passed).
41 lines
1.3 KiB
TOML
41 lines
1.3 KiB
TOML
# The system level and its plugins are separate crates, so the boundary
|
|
# between them is checked by the compiler rather than by discipline: a plugin
|
|
# can reach only what the core makes public, and carries its own version.
|
|
[workspace]
|
|
resolver = "3"
|
|
members = ["crates/*"]
|
|
exclude = ["vendor/mainline"]
|
|
|
|
# Mainline 8.0.0 treats Windows UDP read timeouts as socket failures.
|
|
# Keep the small receive-loop correction reproducible until an upstream fix.
|
|
[patch.crates-io]
|
|
mainline = { path = "vendor/mainline" }
|
|
|
|
[workspace.package]
|
|
edition = "2024"
|
|
rust-version = "1.91"
|
|
license = "MIT OR Apache-2.0"
|
|
repository = "https://github.com/tsunagi-net/tsunagi"
|
|
|
|
[workspace.lints.rust]
|
|
missing_docs = "warn"
|
|
unsafe_code = "deny"
|
|
|
|
[workspace.lints.clippy]
|
|
unwrap_used = "warn"
|
|
expect_used = "warn"
|
|
panic = "warn"
|
|
|
|
[workspace.dependencies]
|
|
iroh = { version = "1.2", default-features = false, features = ["tls-ring", "portmapper"] }
|
|
tokio = { version = "1.53", features = ["rt", "rt-multi-thread", "sync", "time", "macros"] }
|
|
serde = { version = "1.0", features = ["derive"] }
|
|
postcard = { version = "1.1", default-features = false, features = ["use-std"] }
|
|
bytes = "1.12.1"
|
|
thiserror = "2.0"
|
|
tracing = "0.1"
|
|
hex = "0.4"
|
|
data-encoding = "2.11"
|
|
tempfile = "3.24"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|