Module contract

Expand description

The files the hold reads (see the crate docs, the single source).

Constants§

AHEAD_SECS: A stamp further ahead than this is not trusted either (the hold’s script).
CLOCK: The clock every <t> is on: seconds since boot, suspend included (the first field of /proc/uptime), so a wall-clock step cannot make a stale file look fresh.
DIR: Where the footprints live.
FRESH_SECS: A file confirmed longer ago than this is stale.
STATE 🔒: netwatch’s own record of who claimed what, across its restarts (a dot-file: the hold reads only .watch and .unattributed).
TICK_SECS: How often netwatch rewrites every file.
UNATTRIBUTED 🔒
WATCH 🔒

file_name: The file name of a unit’s footprint: systemd’s %N (the unit name with any @instance, without .service). Network tools are system services.
hold_may_release: The hold’s condition on a failure, as lane-nix’s script implements it (crate docs, “The hold’s order”): it may release only when the unit’s footprint describes the invocation that failed (invocation, systemd’s InvocationID), that invocation has ended (its cgroup is gone and the ring drained after, so nothing it did is still to come), and the footprint reads protecting no at now, with nothing unattributed. Anything else holds. The reference the property tests check.
one_line 🔒
parse_footprint 🔒
proto 🔒
put 🔒: Write name in dir atomically: a temporary file, synced, renamed over it.
read: Read what dir holds. Fail closed: a footprint that does not parse is left out (so it reads as missing, which counts as protecting), and an unreadable or unknown .watch is WatchState::Unknown.
read_claims: The claims kept before a restart: .state if it reads, else the footprint files’ iface lines (Tracker::claims_from_files).
render 🔒
write: Write view to dir: .watch, .unattributed (present or removed), and one file per unit; a unit’s file that is no longer in the view is removed, so a reader never trusts a footprint netwatch no longer keeps.
write_state: Keep the tracker’s claims in dir/.state, atomically.