FrogOS/IR
1
0
Fork 0
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions

design: mkName accepts any non-empty text — define allowed charset for service/process/profile names #3

New issue
Open
opened 2026-06-11 15:37:59 +02:00 by yorunikakeru · 0 comments
yorunikakeru commented 2026-06-11 15:37:59 +02:00
Owner
Copy link

`IR.Domain.Error.mkName` rejects only the empty string. `ServiceName "docker; rm -rf /"`, names with newlines, NULs, or path separators are all constructively "valid" and flow downstream to the dinit control socket / Nix layer via the Executor.

The whole point of the smart-constructor layer is that invalid states are unrepresentable — right now "valid name" is defined as "non-empty", which is far weaker than what dinit unit names, /proc comm names (15-byte truncation!), and profile names actually permit.

Define per-type rules, e.g.:

  • ServiceName: dinit unit charset ([A-Za-z0-9_.-]+ or whatever dinit accepts)
  • ProcessName: no NUL/newline; document the 15-char comm truncation behaviour or match on full cmdline
  • ProfileName/ServiceSectionName: identifier-ish, they end up in file paths of generations

Bonus: `mkInterval` in IR.Domain.Error appears unused (IR.ObserveStrategy.mkIntervalMs reimplements it) — drop or reuse.

\`IR.Domain.Error.mkName\` rejects only the empty string. \`ServiceName "docker; rm -rf /"\`, names with newlines, NULs, or path separators are all constructively "valid" and flow downstream to the dinit control socket / Nix layer via the Executor. The whole point of the smart-constructor layer is that invalid states are unrepresentable — right now "valid name" is defined as "non-empty", which is far weaker than what dinit unit names, /proc comm names (15-byte truncation!), and profile names actually permit. Define per-type rules, e.g.: - ServiceName: dinit unit charset ([A-Za-z0-9_.-]+ or whatever dinit accepts) - ProcessName: no NUL/newline; document the 15-char comm truncation behaviour or match on full cmdline - ProfileName/ServiceSectionName: identifier-ish, they end up in file paths of generations Bonus: \`mkInterval\` in IR.Domain.Error appears unused (IR.ObserveStrategy.mkIntervalMs reimplements it) — drop or reuse.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/module-install-configure-pipeline
codex/vhost-policies
refactor/flatten-src-layout
feat/nginx-virtual-host
feat/modules
refactor/27-condition-attach-strategy
module-configure-pipeline-ir
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
FrogOS/IR#3
No description provided.