amadan
host: the system apply header names what the layout guard reads under /data (plan 4 final review)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+7
−0
internal/host/systemapply.go+7 −0
CI passed — run details
diff --git a/internal/host/systemapply.go b/internal/host/systemapply.go| index 9999634c0..da0441136 100644 |
| --- a/internal/host/systemapply.go |
| +++ b/internal/host/systemapply.go |
| @@ -33,6 +33,13 @@ import ( |
| // carlos-system-update.service (or --recover from carlos-system-recover). |
| // Every box-changing step is journaled first; every run begins with |
| // recovery; root reads ONE file under /data and treats it as a hint. |
| +// |
| +// The layout guard (layoutReversalReasons) also touches /data: it opens |
| +// the registry, lists /data/layout, and Lstats the journals there. That |
| +// grants no new privilege. Root's adopt, stage and restart passes already |
| +// open the same registry, the listing and the Lstats follow no symlink |
| +// and read no journal's contents, and all the guard can do with what it |
| +// finds is refuse the install. |
| const ( |
| systemEdgeUnit = "carlos-edge" |