clawverse/clawstor
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: add hot/slab ReadWritePaths to serve service unit

Browse Source 
ProtectSystem=strict in claw-store-serve.service only listed
/var/lib/claw-store as writable. The serve process shells out to
`claw-store activate/deactivate` which also needs to write to:
  /hot/targets  — create/remove hot target dirs
  /slab/projects — write/remove .cargo/config.toml

Subprocess inherits the service's mount namespace, so both paths were
silently read-only, causing activate/deactivate from the dashboard to
return {"ok":false,"error":"Read-only file system (os error 30)"} while
the same commands worked fine from a login shell.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
This commit is contained in:
Omar Sobh
2026-06-30 11:11:41 +00:00
co-authored by Claude Sonnet 4.6
parent f6ff04e9dc
commit 70d1d410bb
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
systemd/claw-store-serve.service
+4 -1
View File
@@ -25,7 +25,10 @@ Environment=RUST_LOG=info
# bind. Re-introduce via ProtectHome=tmpfs + an explicit bind if # bind. Re-introduce via ProtectHome=tmpfs + an explicit bind if
# stronger sandboxing is needed later. # stronger sandboxing is needed later.
ProtectSystem=strict ProtectSystem=strict
ReadWritePaths=/var/lib/claw-store # /var/lib/claw-store — manifest, sync queue, daemon-started file
# /hot/targets — activate/deactivate create/remove hot target dirs
# /slab/projects — activate/deactivate write/remove .cargo/config.toml
ReadWritePaths=/var/lib/claw-store /hot/targets /slab/projects
NoNewPrivileges=true NoNewPrivileges=true
PrivateTmp=true PrivateTmp=true