consistent ownership/permissions for /run/service-state/**

overlay.nix

@@ -89,6 +89,16 @@ final: prev: {
   netlink-lua = final.callPackage ./pkgs/netlink-lua {};
   waitup = final.callPackage ./pkgs/waitup {};
 
+  serviceFns = final.writeText "service-fns.sh" ''
+    output() { cat $1/.outputs/$2; }
+    output_path() { echo $(realpath $1/.outputs)/$2; }
+    mkoutputs() {
+      d=/run/service-state/$1
+      mkdir -m 2750 -p $d && chown root:system $d
+      echo $d
+    }
+  '';
+
   # these are packages for the build system not the host/target
 
   tufted = final.callPackage ./pkgs/tufted {};