1.0.3 — stack DNS dirs per-user

[click0]

Summary

lib/stack.cpp per-stack unbound config + pidfile directory now resolves to /var/run/crate/<uid>/dns-<network>/ when the privops socket is detected. Same lazy-resolve pattern as network_lease.cpp (0.9.27), network_lease6.cpp (1.0.1), spec_registry.cpp (1.0.2).

Four call sites updated:

• generateUnboundConf() — pidfile path in the rendered unbound config (named + default cases)
• startStackDns() — mkdir + path passed to unbound -c <conf>
• stopStackDns() — remove_all cleanup path

Behaviour

Mode	Path
Legacy (no crated)	/var/run/crate/dns-<network>/
Rootless (crated + privops)	/var/run/crate/<uid>/dns-<network>/

Why

Before this release, two operators bringing up stacks with the same network name (e.g. both have a db network) clobbered each other's unbound.conf, fought over the same pidfile, and could deliver SIGTERM to the wrong process at teardown.

Audit reclassification

The original pre-1.0.0 audit flagged lib/pfctl_ops.cpp:28 as "PfLock not per-user". On closer look that's incorrect — pf(4) is host-wide and the lock must serialize across operators, not isolate them. The real bug is that lib/run.cpp calls PfctlOps::addRules etc. directly, which will fail when crate(1) runs as non-root in 1.0.0+. That fix needs the existing AddPfRule privops verb (plus possibly FlushPfAnchor / LoadPfPolicy new verbs) wired through 3 call sites — bigger than a path-leak patch. Tracked for 1.1.0.

Wire / API compatibility

None. The change is internal to stack.cpp; the dnsBaseDir() helper is static (file-local). Suite stays at 1303.

Test plan

• FreeBSD CI lite green
• Linux CI green
• Manual: with crated running, two operators bring up stacks named db; check /var/run/crate/<alice-uid>/dns-db/ and /var/run/crate/<bob-uid>/dns-db/ both exist with separate unbound processes
• Manual: legacy mode (no crated) — /var/run/crate/dns-db/ still used

---

Generated by Claude Code