remote-access-design.md §2.5 and §2.6 say the credential at /etc/robot/hf-token is 0640 root:robot, so only root and mediad can read it, and updater/src/account.rs puts it in that group on purpose. the units say something else. robot is the socket group, it is how any client reaches a daemon's 0660 socket at all, so btd.service, padd.service and tofd.service all carry SupplementaryGroups=robot, and install.sh and provision.sh add the operator's own account to it as well. so the owner's hugging face bearer token, which §7 says can still write to their repositories, is readable by the bluetooth daemon that parses bytes from anyone in radio range, by the gamepad daemon that the repository describes as the process whose whole value is having no privileged access, by the depth sensor daemon, and by every shell user on the board.
none of those is a known way in, and this is a boundary drawn in the wrong place rather than a break. but the design spent a section on this file's mode precisely so that the boundary would be the file's, and the group it chose is the one that means everybody.
the fix is a group of its own with mediad as its only member, created by the sysusers.d files the release already ships, granted in mediad.service, and named in account.rs. i ran the two sysusers files through systemd-sysusers on a debian trixie root and got robot-account:x:998:mediad. branch coming.
on main at 5984efb.
remote-access-design.md§2.5 and §2.6 say the credential at/etc/robot/hf-tokenis0640 root:robot, so only root andmediadcan read it, andupdater/src/account.rsputs it in that group on purpose. the units say something else.robotis the socket group, it is how any client reaches a daemon's0660socket at all, sobtd.service,padd.serviceandtofd.serviceall carrySupplementaryGroups=robot, andinstall.shandprovision.shadd the operator's own account to it as well. so the owner's hugging face bearer token, which §7 says can still write to their repositories, is readable by the bluetooth daemon that parses bytes from anyone in radio range, by the gamepad daemon that the repository describes as the process whose whole value is having no privileged access, by the depth sensor daemon, and by every shell user on the board.none of those is a known way in, and this is a boundary drawn in the wrong place rather than a break. but the design spent a section on this file's mode precisely so that the boundary would be the file's, and the group it chose is the one that means everybody.
the fix is a group of its own with
mediadas its only member, created by thesysusers.dfiles the release already ships, granted inmediad.service, and named inaccount.rs. i ran the two sysusers files throughsystemd-sysuserson a debian trixie root and gotrobot-account:x:998:mediad. branch coming.on main at 5984efb.