mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

hive-priv: create the nixos-containers directories at boot

Browse source
This commit is contained in:
atlas 2026-11-13 07:37:18 +01:00 • committed by mara
commit bf77b72217
1 changed files with 42 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

27
nix/module-eval/core-toggle.nix
View file

@ -2339,6 +2339,33 @@ let
&& (sc.ProtectKernelLogs or false)
&& (sc.ProtectKernelModules or false);
}
{
# A path in `ReadWritePaths` without a `-` prefix must exist or the unit
# fails with 226/NAMESPACE, and a hive with no declared container has no
# /etc/nixos-containers. Each required-to-exist path is created by a
# tmpfiles rule. Presence control: the other rule in the list is found by
# the same lookup; the toggled-off fixture has no hive-priv and no rule.
name = "hive-priv's ReadWritePaths directories are all created by tmpfiles rules";
ok =
let
rules = allLocal.systemd.tmpfiles.rules;
rw = allLocal.systemd.services.hive-priv.serviceConfig.ReadWritePaths;
created = [
"/run/hive-agent"
"/etc/nixos-containers"
"/var/lib/nixos-containers"
];
hasRule = p: lib.any (r: lib.hasPrefix "d ${p} " r) rules;
in
lib.all (p: lib.elem p rw && hasRule p) created
&& lib.elem "d /etc/nixos-containers 0755 root root - -" rules
&& lib.elem "d /var/lib/nixos-containers 0700 root root - -" rules
&& !(lib.any (p: lib.hasPrefix "-" p) rw)
&& hasRule "/var/lib/hyperhive/agents"
&& !(lib.any (
r: lib.hasPrefix "d /etc/nixos-containers " r
) centralToggleOff.systemd.tmpfiles.rules);
}
{
# Hyperhive's own declarative containers each run the root check from
# their own unit, warn-only. Every container in these fixtures is one of