Merge pull request 'A filter module's own filter file counts as declared for a mount (hq ADR 0169)' (#213) from feat/the-firewall-seat-serves-its-verbs into main

internal/catalogue/manifest.go

@@ -1810,6 +1810,12 @@ func (m Manifest) undeclaredMounts() []string {
 			claim(p)
 		}
 	}
+	// The file a filter module's rule set is written to is declared by `filtering.into`: the mesh
+	// writes it, the module loads it, and the module's runtime may read it back to reload the
+	// mesh's own table (novox/hq ADR 0169).
+	if m.Filtering != nil {
+		claim(m.Filtering.Into)
+	}
 	// Under a declared directory is declared: a module that says where its data lives has said so
 	// for what it puts inside.
 	covers := func(path string) bool {

internal/catalogue/mounts_test.go

@@ -98,3 +98,13 @@ func TestAMountOfABoundFactIsAccepted(t *testing.T) {
 		t.Fatalf("a mount of the file the mesh writes a binding to was refused: %v", err)
 	}
 }
+
+// The file a filter module's rule set is written to is declared by `filtering.into` (novox/hq ADR
+// 0169): the module's runtime mounts it to reload the mesh's own table, and nothing else declares it.
+func TestAMountOfTheFilterFileIsDeclaredByFilteringInto(t *testing.T) {
+	_, err := ParseManifest([]byte(`{"module":"nftables","filtering":{"into":"/etc/nftables.conf"},` +
+		`"resources":[` + strings.Replace(aContainerMounting, "%s", "/etc/nftables.conf", 1) + `]}`))
+	if err != nil {
+		t.Fatalf("a filter module mounting its own filter file was refused: %v", err)
+	}
+}