From 8232297f4d516fb4a15f624479358329b3aaa048 Mon Sep 17 00:00:00 2001 From: Roberto Cano Date: Thu, 6 Aug 2026 14:00:08 +0200 Subject: [PATCH] fix(gen-audit-rules): emit the unit-dir watch once per user, not per repo The ~/.config/systemd/user/ watch is a property of the agent USER, but the generator emitted it inside the per-registry-line loop. With several repos consolidated under one agent user -- a topology the registry explicitly permits -- the identical rule is generated once per repo and auditd rejects the duplicates ("Rule exists", error in audit.rules) on every load, including every boot. A recurring load error on the audit layer is noise that trains the operator to ignore the one channel that must stay credible. Emit repo-scoped watches in the per-line loop and user-scoped watches in a second pass over unique users. Found live on the first consolidated-registry load (recode-agent hosting both reCode and reDeploy). Co-Authored-By: Claude Fable 5 --- examples/dedicated-server/bin/gen-audit-rules.sh | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/examples/dedicated-server/bin/gen-audit-rules.sh b/examples/dedicated-server/bin/gen-audit-rules.sh index 9a780ac..c552f47 100755 --- a/examples/dedicated-server/bin/gen-audit-rules.sh +++ b/examples/dedicated-server/bin/gen-audit-rules.sh @@ -20,5 +20,17 @@ while IFS=: read -r user repo; do echo "-w $repo/self/ -p wa -k ${key}_self" echo "-w $repo/.env -p wa -k ${key}_env" echo "-w $repo/.claude/settings.local.json -p wa -k ${key}_settings" - echo "-w /home/$user/.config/systemd/user/ -p wa -k ${key}_units" done < "$CONF" + +# The unit-dir watch is per USER, not per repo: with several repos consolidated +# under one agent user, emitting it per registry line makes auditd reject the +# duplicate ("Rule exists") on every load, including every boot. +echo +echo "# --- per-user systemd unit dirs ---" +while IFS=: read -r user repo; do + case "${user:-}" in ''|\#*) continue ;; esac + printf '%s\n' "$user" +done < "$CONF" | sort -u | while read -r user; do + key=$(printf '%s' "$user" | tr -c 'a-zA-Z0-9' '_') + echo "-w /home/$user/.config/systemd/user/ -p wa -k ${key}_units" +done