Put the view's socket in /var/lib/mesh-delivery-view-cli: the node-engine never places a module's directory below /run (issue 1134)

modules/mesh-delivery-view/cmd/mesh-delivery-cli/main.go

@@ -12,7 +12,7 @@ import (
 	"mesh-delivery-view/internal/view"
 )
 
-const defaultSocket = "/run/mesh-delivery-view/cli.sock"
+const defaultSocket = "/var/lib/mesh-delivery-view-cli/cli.sock"
 
 func main() {
 	socket := os.Getenv("MESH_DELIVERY_SOCKET")

modules/mesh-delivery-view/cmd/mesh-delivery-view/main.go

@@ -30,7 +30,7 @@ import (
 )
 
 const (
-	defaultSocket = "/run/mesh-delivery-view/cli.sock"
+	defaultSocket = "/var/lib/mesh-delivery-view-cli/cli.sock"
 	defaultWeb    = "127.0.0.1:8471"
 )
 

modules/mesh-delivery-view/manifest_test.go

@@ -155,7 +155,7 @@ func TestManifestResources(t *testing.T) { // 1134/AC7
 		if d["id"] == "state" && d["mode"] == "0700" && d["owner"] == user {
 			state = true
 		}
-		if d["path"] == "/run/mesh-delivery-view" && d["mode"] == "0755" && d["owner"] == user {
+		if d["path"] == "/var/lib/mesh-delivery-view-cli" && d["mode"] == "0755" && d["owner"] == user {
 			run = true
 		}
 	}
@@ -220,3 +220,29 @@ func TestNoSharedDirectoryIsClaimed(t *testing.T) { // 1134/AC7
 		t.Errorf("files/mesh-delivery-cli = %q, %v", raw, err)
 	}
 }
+
+// The node-engine never places a module-owned directory below /etc, /usr, /run or /var/run: they are root's
+// (mesh-host internal/apply/placement_guard.go:80, rootsOnly; novox/hq issue 339).
+func TestNoDirectoryBelowRootsTrees(t *testing.T) { // 1134/AC10
+	m, _ := load(t)
+	for _, r := range m.Resources {
+		if r["type"] != "directory" {
+			continue
+		}
+		p, _ := r["path"].(string)
+		for _, root := range []string{"/etc", "/usr", "/run", "/var/run"} {
+			if p == root || strings.HasPrefix(p, root+"/") {
+				t.Errorf("directory %v at %s is below %s, which is root's", r["id"], p, root)
+			}
+		}
+	}
+	var socketDir bool
+	for _, r := range m.Resources {
+		if r["path"] == "/var/lib/mesh-delivery-view-cli" && r["type"] == "directory" && r["mode"] == "0755" && r["owner"] == "mesh-delivery-view" {
+			socketDir = true
+		}
+	}
+	if !socketDir {
+		t.Error("the socket's directory is /var/lib/mesh-delivery-view-cli, 0755, owned by mesh-delivery-view")
+	}
+}

modules/mesh-delivery-view/module.json

@@ -31,9 +31,9 @@
       "unknown": "program"
     },
     {
-      "id": "run",
+      "id": "socket-dir",
       "type": "directory",
-      "path": "/run/mesh-delivery-view",
+      "path": "/var/lib/mesh-delivery-view-cli",
       "mode": "0755",
       "owner": "mesh-delivery-view",
       "unknown": "program"