Enum CallerPrincipal 

pub enum CallerPrincipal {
    Uid(u32),
    VsockToken,
    Unattributed,
}

Who asked, as opposed to what they were allowed to do.

CallerRole answers “was this permitted”; two members of sysknife-admin share a role and are indistinguishable by it. The principal answers “which account”, and is signed into the audit chain (crate::audit_chain::ChainIdentity::V3) so the trail can name the account rather than the class.

An account is not a person: a uid survives su, shared logins, and reuse after a user is deleted. See the attribution-strength limit in SECURITY.md.

Every rendering is scheme:value, and the scheme is signed along with the value on purpose, because the strength of the evidence differs. uid:1000 was attested by the kernel through SO_PEERCRED. token:vsock means a pre-shared secret was presented, and any holder of that file could have presented it. none:unattributed means the daemon could establish neither. A bare string would erase those distinctions.

Variants

Uid(u32)

A Unix-socket peer whose uid the kernel supplied at connect().

VsockToken

A vsock connection authenticated by the pre-shared token. No uid exists on that path: the peer is in another kernel.

Unattributed

The daemon could not establish an account for this connection, either because SO_PEERCRED failed, or because it returned no usable pid, or because the peer is not representable in this daemon’s namespaces (the kernel then reports the overflow uid, which names nobody rather than the caller).

The connection is still handled, at Observer (the pre-existing fallback), and the row records that attribution failed instead of inventing a uid. A signed lie about who acted would be worse than a signed admission of ignorance.

Implementations

impl CallerPrincipal

pub fn scheme(&self) -> &'static str

Evidence class of this principal. Signed as the part before the colon.

Split out from Self::as_signed_str so a new variant cannot be added without declaring which class it belongs to, and so every_principal_renders_as_a_known_scheme can walk the whole set.

pub fn as_signed_str(&self) -> String

The exact string signed into the chain and stored in caller_principal.

Never empty for any variant, which matters: ChainRow::identity treats an empty principal on a chain_version = 3 row as a missing one and reports the row broken. A variant that rendered empty would turn every honest row on an affected host into a false tamper report.

pub fn claim(&self) -> PrincipalClaim

What this principal claims about who acted.

Exhaustive on self, so a new variant cannot be added without deciding here whether it names an account. Self::classify answers for a stored string by rebuilding the variant and then asking this.

pub fn classify(stored: &str) -> PrincipalClaim

Read a stored caller_principal back into what it claims about who acted.

Deliberately the inverse of Self::as_signed_str and kept beside it, so the writer and the reader of this column cannot drift apart.

This is not a parse into Self for the caller’s use, and that is the point: it classifies strings this daemon may never have written. The census reads a database column rather than a live connection, so it meets rows that were tampered with, and rows signed by a newer daemon using a scheme this binary does not know. Both must come back as PrincipalClaim::Unrecognized instead of being credited as an account: a report that turns an unreadable principal into “someone was named” is the failure mode worth designing against.

Trait Implementations

impl Clone for CallerPrincipal

fn clone(&self) -> CallerPrincipal

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for CallerPrincipal

impl Debug for CallerPrincipal

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for CallerPrincipal

impl PartialEq for CallerPrincipal

fn eq(&self, other: &CallerPrincipal) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for CallerPrincipal