packaging/freebsd/agent-jail-bootstrap.sh

@@ -11,6 +11,7 @@ set -eu
 
 JAIL_NAME="${1:-}"
 PKG_CACHE_DIR="${PKG_CACHE_DIR:-/var/cache/pkg}"
+DAEMON_USER="${DAEMON_USER:-clawdie}"
 
 # The jail name becomes a path component, so reject anything that could escape
 # /usr/local/bastille/jails/<name>/root (empty, traversal, odd characters).
@@ -97,4 +98,11 @@ if ! grep -q '/etc/profile.d/clawdie-npm.sh' "${JAIL_ROOT}/etc/profile" 2>/dev/n
         >> "${JAIL_ROOT}/etc/profile"
 fi
 
+# Pre-create the daemon's per-spawn staging directory. The daemon runs as
+# ${DAEMON_USER} and stages launch.sh/env.sh under <stage_id> subdirs here, so
+# it must own this directory. Created clawdie-owned 0700 rather than left for a
+# root-owned /var/run to block (the spawn EACCES) or patched world-writable.
+install -d -o "${DAEMON_USER}" -g "${DAEMON_USER}" -m 0700 \
+    "${JAIL_ROOT}/var/run/colibri-stage"
+
 echo "Done — ${JAIL_NAME} ready for vault provision."