From 8303c5b831b8f11f853b351385ebb7a25e1f79b3 Mon Sep 17 00:00:00 2001
From: kaka <kaka@git.com>
Date: Wed, 4 Nov 2026 18:58:25 +0800
Subject: [PATCH] Keep baseline lock outside writable system lock directory

---
 host-baseline.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/host-baseline.sh b/host-baseline.sh
index 8ed9f2d..82ba336 100644
--- a/host-baseline.sh
+++ b/host-baseline.sh
@@ -142,8 +142,8 @@ main() {
   preflight
   if [[ "$action" == --preflight ]]; then echo 'Network baseline preflight passed; no configuration changed.'; return; fi
   umask 077
-  trusted /run/lock/platform-host-baseline.lock
-  exec 9>>/run/lock/platform-host-baseline.lock; flock -n 9 || { fail 'Baseline maintenance already running'; return 1; }
+  trusted /run/platform-host-baseline.lock
+  exec 9>>/run/platform-host-baseline.lock; flock -n 9 || { fail 'Baseline maintenance already running'; return 1; }
   [[ ! -e /var/lib/platform-bootstrap/ssh/pending && ! -e /run/platform-firewall/pending.nft ]] || { fail 'Resolve pending SSH/firewall maintenance before network tuning'; return 1; }
   preflight
   if [[ $(sysctl -n net.ipv4.tcp_congestion_control) == bbr && $(sysctl -n net.core.default_qdisc) == fq &&