carlos / platform Public

zdd plan 2 task 13: claim control unit keeps its roots after the drop-in path widening

Task 7 widened carlos-instance-control.service to
"ReadWritePaths=/run/carlos-control /run/systemd/system", but
claimUnitContent still matched the old one-path line. With the host
claim flag on, the rewrite silently did nothing and the claim control
service lost /run/carlos, the data and opt roots, /etc/systemd/system
and /sys/fs/cgroup. Match the new line and keep /run/systemd/system in
the claim roots so the per-generation drop-in still works.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 2 weeks ago e3626eec505648f65d02c09a03e50fb71949db82 parent dd3cba8

2 files changed, +3 −3

internal/host/claimunit.go +2 −2
internal/host/claimunit_test.go +1 −1

diff --git a/internal/host/claimunit.go b/internal/host/claimunit.go

index 5d84859ff..50bd00e9e 100644

--- a/internal/host/claimunit.go

+++ b/internal/host/claimunit.go

@@ -96,12 +96,12 @@ func claimUnitContent(name string, content []byte, cfg claimUnitSettings) []byte

}

return strconv.Quote(strings.ReplaceAll(p, "%", "%%"))

}

- roots := []string{"/run/carlos-control", "/run/carlos", cfg.data, cfg.opt, "/etc/systemd/system", "/sys/fs/cgroup"}

+ roots := []string{"/run/carlos-control", "/run/carlos", cfg.data, cfg.opt, "/etc/systemd/system", "/sys/fs/cgroup", "/run/systemd/system"}

for i, p := range roots {

roots[i] = quote(p)

}

content = bytes.Replace(content, []byte("[Service]\n"), []byte("[Service]\n"+claimControlEnvironment), 1)

- content = bytes.Replace(content, []byte("ReadWritePaths=/run/carlos-control\n"), []byte("ReadWritePaths="+strings.Join(roots, " ")+"\n"), 1)

+ content = bytes.Replace(content, []byte("ReadWritePaths=/run/carlos-control /run/systemd/system\n"), []byte("ReadWritePaths="+strings.Join(roots, " ")+"\n"), 1)

return bytes.Replace(content, []byte("RestrictAddressFamilies=AF_UNIX\n"), []byte("RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6\n"), 1)

}

diff --git a/internal/host/claimunit_test.go b/internal/host/claimunit_test.go

index e86d71f47..9d3169f0e 100644

--- a/internal/host/claimunit_test.go

+++ b/internal/host/claimunit_test.go

@@ -77,7 +77,7 @@ func TestClaimControlUnitInstallers(t *testing.T) {

}

for key, want := range map[string][]string{

"EnvironmentFile": {"-/etc/carlos/host.env"},

- "ReadWritePaths": {"/run/carlos-control /run/carlos /data /opt/carlos /etc/systemd/system /sys/fs/cgroup"},

+ "ReadWritePaths": {"/run/carlos-control /run/carlos /data /opt/carlos /etc/systemd/system /sys/fs/cgroup /run/systemd/system"},

"RestrictAddressFamilies": {"AF_UNIX AF_INET AF_INET6"},

"ProtectSystem": {"strict"},

"ProtectHome": {"yes"},