B-23 · Medium
planarian @ a924e09 · Spec v4.6 · snapshot main · all versions
A network tool that exists only as a raw unit file (shipped in a package through
systemd.packagesand never declared insystemd.services) is not classified: the build-time rule reads the module system’s configuration, and reading unit files at evaluation would be import from derivation. Its failure holds nothing, and it is not ordered after netwatch. User units are not this gap: a user manager grants no capabilities, so a user unit steers host traffic only by asking a system service (whose footprint carries the change) or through a setuid or file-capability binary (the parked gap in #38). Related, and failing closed rather than open: with networking in the systemd initrd (boot.initrd.network, or networkd there), links and routes still standing at switch-root were made before netwatch existed and read aspre-attach, so every network tool’s failure holds until they are gone
| Breaks | Status | Mitigation | Closes in |
|---|---|---|---|
| Correct (§12d overstated) | Open | Workaround: declare the unit in systemd.services (even only systemd.services.<name> = { }; beside the package; NixOS writes it as a drop-in over the package’s file), and it is classified, held and ordered. Fix: classify raw units at build time from the unit tree itself (the drop-in package reading the files it ships beside), not at evaluation | B |
The guarantees it narrows
None: a process or availability row.