Hermes
993b9c559c
SECURITY CHANGE: Keep ai-worker in docker group but block dangerous docker subcommands via a wrapper script. Approach: - docker group membership preserved (ps, start, stop, compose still work) - Docker binary wrapped with a script that blocks dangerous subcommands - BLOCKED: exec, cp, commit, diff, export, import, load, save, attach, push, tag - ALLOWED: ps, images, inspect, logs, start, stop, restart, rm, rmi, pull, build, run, compose, system, network ls, volume ls The wrapper is installed in both system packages and ai-worker's personal profile to ensure it takes precedence over the real docker. This is effective for the LLM agent threat model — the agent uses CLI commands and blocked subcommands simply return an error. Files modified: - users/ai-worker.nix — restored docker group, kept sudo audit rules - modules/nixos/security/ai-worker-restricted.nix — added docker wrapper script with blacklist logic and NixOS module integration - modules/nixos/security/README-ai-worker.md — documentation update
84 lines
2.6 KiB
Nix
84 lines
2.6 KiB
Nix
{ pkgs, inputs, config, keys, ... }: {
|
|
users.users.ai-worker = {
|
|
isSystemUser = true;
|
|
group = "ai-worker";
|
|
home = "/home/ai-worker";
|
|
createHome = true;
|
|
# ai-worker stays in docker group for normal docker operations (ps, start, stop, compose, ...)
|
|
# Dangerous commands (exec, cp, commit) are blocked by a wrapper script.
|
|
extraGroups = [ "docker" ];
|
|
shell = pkgs.bashInteractive;
|
|
openssh.authorizedKeys.keys = [
|
|
keys.users.ai-worker.main
|
|
];
|
|
# No password login - SSH key only
|
|
hashedPassword = "!";
|
|
};
|
|
users.groups.ai-worker = {};
|
|
|
|
# Enable restricted AI worker SSH access
|
|
# SECURITY: ai-worker is in docker group but docker commands are filtered:
|
|
# ALLOWED: ps, images, logs, start, stop, restart, rm, rmi, pull, build, run, compose
|
|
# BLOCKED: exec, cp, commit, diff, export, import, load, save, attach, push
|
|
# The filtering is done by a docker wrapper in ai-worker's PATH.
|
|
services.aiWorkerAccess = true;
|
|
|
|
# Restricted sudo for ai-worker - security checks only (not for docker)
|
|
security.sudo.extraRules = [
|
|
{
|
|
users = [ "ai-worker" ];
|
|
commands = [
|
|
# Firewall checks
|
|
{
|
|
command = "/run/wrappers/bin/sudo iptables -L -n -v";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/wrappers/bin/sudo iptables -S";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
# Fail2ban status
|
|
{
|
|
command = "/run/current-system/sw/bin/fail2ban-client status";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/current-system/sw/bin/fail2ban-client status *";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/current-system/sw/bin/fail2ban-client get * banned";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
# Log inspection
|
|
{
|
|
command = "/run/current-system/sw/bin/journalctl -t kernel -n 100";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/current-system/sw/bin/journalctl -u fail2ban -n 50";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/current-system/sw/bin/journalctl -u firewall -n 50";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
# SSH config verification
|
|
{
|
|
command = "/run/current-system/sw/bin/sshd -T";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
# Network diagnostics
|
|
{
|
|
command = "/run/current-system/sw/bin/ss -tlnp";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
{
|
|
command = "/run/current-system/sw/bin/cat /proc/net/tcp";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
}
|