From 29404f996431a96985b9fb8e3d53a8d56340cfc5 Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Tue, 20 Oct 2026 15:38:44 -0500 Subject: [PATCH] gosalyn: Case 2 C2-13 brief cites stack-copy.sh's copy id rule --- docs/plans/2026-10-20_case2-rows.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/plans/2026-10-20_case2-rows.md b/docs/plans/2026-10-20_case2-rows.md index 8ccb98ed5..a126f1fd0 100644 --- a/docs/plans/2026-10-20_case2-rows.md +++ b/docs/plans/2026-10-20_case2-rows.md @@ -750,8 +750,9 @@ precheck take `--profile factory|library`, default `library`: - It renders the unit from the checkout's template, with the user, the home and the copy id as inputs. - It refuses unless `User=`, `Group=`, `ExecStart=` and the hardening lines match fixed values. The copy id is the one part of `ExecStart=` that varies, so a re-pin to a new copy can re-render the - unit (row 195). It must be exactly 40 lowercase hex characters naming an existing directory directly - under ``'s copies dir. Anything else refuses before the render. + unit (row 195). It must be exactly 40 lowercase hex characters naming a copy that holds `scripts/mosaic`, + directly under `/.local/share/mosaic-stack/copies`. That is the rule `copy_root` uses + (`scripts/stack-copy.sh:6`, `:20`). Anything else refuses before the render. - It refuses any `PermissionsStartOnly=`, and any `Exec*=` value whose leading run of prefix characters (`@`, `-`, `:`, `+`, `!`) holds a `+` or `!`. systemd takes those prefixes in any order, so `-+/srv/mosaic/x` runs as root even with `User=mosaic`. The named-line check doesn't read these