carlos / platform Public

host: tmpfiles provisions /run/carlos/hostguard and /data/hostguard (claim Plan 3 Task 7)

Co-Authored-By: Codex <noreply@openai.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

codex pushed by claude 2 weeks ago 4b67594b19d3990236db8d4504a1bf66ac869e3e parent 8e90a39

2 files changed, +4 −0

diff --git a/internal/host/bootstrap.go b/internal/host/bootstrap.go

index b04bd7fde..5831faf10 100644

--- a/internal/host/bootstrap.go

+++ b/internal/host/bootstrap.go

@@ -60,6 +60,8 @@ const socketsGroup = "carlos-sockets"

// tenants. other=0 on both dirs keeps every unenrolled uid out.

const tmpfilesConf = "d /run/carlos 2750 " + serviceUser + " " + socketsGroup + " -\n" +

"d /run/carlos/apps 0750 " + serviceUser + " " + serviceUser + " -\n" +

+ "d /run/carlos/hostguard 2770 " + serviceUser + " " + serviceUser + " -\n" +

+ "d /data/hostguard 2770 " + serviceUser + " " + serviceUser + " -\n" +

// The isolated-exec trees (design §3.1, §3.2). Each protected view is

// a nosymfollow bind of the dotted raw directory beside it (the mount

// units); tmpfiles creates both every boot because /run is tmpfs and

diff --git a/internal/host/units_isolation_test.go b/internal/host/units_isolation_test.go

index 8ebeb9588..d612ff837 100644

--- a/internal/host/units_isolation_test.go

+++ b/internal/host/units_isolation_test.go

@@ -134,6 +134,8 @@ func TestTmpfilesCreatesTheInstanceTrees(t *testing.T) {

"d /run/carlos/.logs 0700 carlos carlos -",

"d /run/carlos/logs 0700 carlos carlos -",

"d /run/carlos-control 0750 root carlos -",

+ "d /run/carlos/hostguard 2770 carlos carlos -",

+ "d /data/hostguard 2770 carlos carlos -",

"f /etc/carlos/probe-secret 0640 root carlos - probe",

"f /dev/shm/carlos-probe 0644 root root - probe",

} {