32 lines
2.0 KiB
Plaintext
32 lines
2.0 KiB
Plaintext
# UNINSTALLED additional user@1000.service drop-in, composed with 80-runtime-user.
|
|
# The network namespace must have qualified routing and finite IPC forwarding.
|
|
# Hiding the system bus without replacing required host operations is NOT UAT.
|
|
[Service]
|
|
# Gate the entire user manager before enabled Quadlets or Podman can bootstrap.
|
|
# Runs in NetworkNamespacePath below, never uses host readiness as a substitute.
|
|
ExecCondition=/usr/bin/python3 -I -S /usr/libexec/runtime_uplink.py --c01 --runtime-dir=/run/user/1000
|
|
TimeoutStartSec=90
|
|
# user@.service's host-view PAM cleanup child cannot meet the runtime boundary.
|
|
# This specific manager has no login/PAM session. user-runtime-dir@1000.service
|
|
# must provision /run/user/1000; systemd supplies User/Group and the 80 drop-in
|
|
# supplies HOME. Qualify the real manager/Podman lifecycle before installing.
|
|
PAMName=
|
|
Environment=XDG_RUNTIME_DIR=/run/user/1000
|
|
UMask=0077
|
|
KeyringMode=private
|
|
NetworkNamespacePath=/run/netns/archipelago-runtime
|
|
# Runtime keeps original data UID/inodes, but never a writable package view.
|
|
# Retirement of pre-existing writable FDs is still the access owner's job.
|
|
ReadOnlyPaths=/opt/archipelago /usr/local/bin
|
|
InaccessiblePaths=-/usr/bin/sudo -/usr/bin/pkexec -/usr/bin/su -/usr/bin/doas
|
|
InaccessiblePaths=-/usr/bin/chsh -/usr/bin/chfn -/usr/bin/passwd -/usr/bin/crontab -/usr/bin/at
|
|
InaccessiblePaths=-/run/dbus -/run/systemd/private -/run/sudo -/run/polkit-1
|
|
# ProtectHome=tmpfs already removes other homes. A required inaccessible mount
|
|
# on an absent admin home would fail the real user manager at NAMESPACE setup.
|
|
# If visible it must be covered; absence is also denial (checked by the owner).
|
|
InaccessiblePaths=/root -/home/archipelago-admin @MANAGER_PARENT@ @SNAPSHOT_PARENT@ @AUTHORITY_PARENT@
|
|
# ProtectHome=tmpfs and curated HOME binding are supplied by the 80 drop-in.
|
|
# Keep newuidmap/newgidmap functional: do not blanket NoNewPrivileges=yes on the
|
|
# original UID's rootless Podman user manager. Effective sudo/polkit/SSH/account
|
|
# policy is installed by the reviewed transition, not granted by this drop-in.
|