AIOS Governed Continuation
abe81d7f64
Ported from authority branch agent/g7-security-critical-closure-20260914 (d5f5c9b, base=beabd053).
S1 auth: role/user from server token->identity mapping, ignore client X-AIOS-* headers.
S2 bootstrap credential: PBKDF2 random-salt, fail-closed SECRET, no plaintext fallback, session HMAC+expiry.
S3 path containment + control-plane file-read hardening.
S4 admin UI XSS + real governed approval + dashboard CSRF/branch validation.
S5 runtime delivery: registry.yaml conflict, openapi securityScheme, install.sh fail propagation, do_POST shadowing.
Tests: 5 negative suites (66 tests). Evidence pack in deliverables/g7-evidence/.
47 lines
1.4 KiB
Bash
47 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
echo "[AIOS] Installing Autonomous GitOps System..."
|
|
|
|
WORKDIR=/data/aios-gitops/workspace
|
|
ETC=/etc/aios
|
|
RUNTIME=/data/aios-gitops/runtime
|
|
SERVICE_USER=aios
|
|
|
|
if ! id "$SERVICE_USER" >/dev/null 2>&1; then
|
|
echo "[AIOS] Creating system user: $SERVICE_USER"
|
|
useradd --system --home /data/aios-gitops --shell /usr/sbin/nologin "$SERVICE_USER"
|
|
fi
|
|
|
|
mkdir -p "$ETC"
|
|
cp deploy/systemd/aios-autonomous-daemon.env.template "$ETC/aios-autonomous-daemon.env"
|
|
|
|
mkdir -p \
|
|
"$RUNTIME/events" \
|
|
"$RUNTIME/audit" \
|
|
"$RUNTIME/requests" \
|
|
"$RUNTIME/reports/codex" \
|
|
"$RUNTIME/approvals/preapproved" \
|
|
"$RUNTIME/integrations/v1r1-personal-wechat/outbox" \
|
|
"$RUNTIME/integrations/v1r1-personal-wechat/inbox" \
|
|
"$RUNTIME/integrations/v1r1-personal-wechat/status"
|
|
|
|
chown -R "$SERVICE_USER:$SERVICE_USER" /data/aios-gitops/runtime || true
|
|
chown -R "$SERVICE_USER:$SERVICE_USER" "$WORKDIR" || true
|
|
|
|
cp deploy/systemd/aios-autonomous-daemon.service /etc/systemd/system/
|
|
cp deploy/systemd/aios-v1r1-wechat-worker.service /etc/systemd/system/
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable aios-autonomous-daemon.service
|
|
systemctl enable aios-v1r1-wechat-worker.service
|
|
|
|
systemctl restart aios-autonomous-daemon.service
|
|
systemctl restart aios-v1r1-wechat-worker.service
|
|
|
|
sleep 2
|
|
systemctl status aios-autonomous-daemon.service --no-pager || true
|
|
systemctl status aios-v1r1-wechat-worker.service --no-pager || true
|
|
|
|
echo "[AIOS] Installation complete"
|