coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Create private evidence directories safely on fsGroup volumes

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-11 12:41:04 +02:00
parent bda9381f07
commit 1a12223574
5 changed files with 57 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
deploy/README.md
View file

@ -56,7 +56,9 @@ Kubernetes projected ConfigMaps are root-owned and symlinked. The container
entrypoint reads at most 16 KiB from `/configuration/runtime.json`, requires
`evidence_db=/data/private/review.sqlite`, and copies the configuration into
owned ephemeral storage at `/run/informed-decision/private/runtime.json` (0600).
It creates `/data/private` as the process user with mode 0700 and refuses unsafe
It creates `/data/private` as the process user with mode 0700, clearing the
inherited setgid bit only on directories it just created on fsGroup volumes,
and refuses unsafe
existing ownership/modes. It does not silently chmod or take over existing data.
The evidence database remains 0600. Credential callbacks read rotating projected
files directly; bearer tokens are never copied into SQLite or the config snapshot.