oxmc
a86ad3298e
This checkout is PawletOS's fork (git.oxmc.me/PawletOS/profiled), so its own identity should read PawletOS, not VesperOS: binary/package name, AIDL package+interface (me.oxmc.vesperos.profile -> os.pawlet.profiled), D-Bus service/object/error names, C++ namespace (vesperos::profile -> pawletos::profile), sepolicy types, data paths (/data/system/vesperos -> /data/system/pawletos, /etc/vesperprofiled -> /etc/pawletprofiled), the vendored OpenSSL static-lib module names, and the ZTE protocol string. Also drops generated build output (obj-x86_64-linux-gnu/, debian/.debhelper, debian staging dir, debhelper log/substvars files) that had been committed by mistake, and adds a .gitignore so they don't come back. The stock/upstream vesperprofiled at git.oxmc.me/VesperOS/vesperprofiled is untouched -- this commit only goes to the pawletos remote.
56 lines
1.5 KiB
Desktop File
56 lines
1.5 KiB
Desktop File
[Unit]
|
|
Description=PawletOS Profile Daemon (profiles + Zero-Touch Enrollment)
|
|
Documentation=https://pawletos.oxmc.me/docs/pawletprofiled
|
|
|
|
# Must run before cloud-init so preinstalled profiles (WiFi, MDM drop-ins,
|
|
# first-boot config) are on disk when cloud-init starts.
|
|
Before=cloud-init-local.service cloud-init.service
|
|
After=local-fs.target dbus.service systemd-udev-settle.service
|
|
|
|
# Start after NetworkManager so ZTE can immediately check current
|
|
# connectivity state rather than waiting for a StateChanged signal.
|
|
After=NetworkManager.service
|
|
# But don't hard-require NM — ZTE degrades gracefully if NM isn't present.
|
|
Wants=NetworkManager.service
|
|
|
|
[Service]
|
|
Type=notify
|
|
NotifyAccess=main
|
|
|
|
ExecStart=/usr/sbin/pawletprofiled
|
|
ExecReload=/bin/kill -HUP $MAINPID
|
|
|
|
User=root
|
|
Group=root
|
|
|
|
# Restart the whole daemon (profile service + ZTE watcher) on crash.
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
TimeoutStartSec=60
|
|
|
|
RuntimeDirectory=pawletprofiled
|
|
RuntimeDirectoryMode=0750
|
|
StateDirectory=pawletprofiled
|
|
StateDirectoryMode=0700
|
|
|
|
# Writable paths — profile daemon writes config drops, ZTE writes state
|
|
ReadWritePaths=/etc /var/lib/pawletprofiled /run/pawletprofiled \
|
|
/var/lib/gnome-initial-setup
|
|
|
|
SystemCallFilter=@system-service @file-system @network-io @process
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
NoNewPrivileges=false
|
|
PrivateTmp=true
|
|
ProtectKernelLogs=true
|
|
ProtectKernelModules=true
|
|
ProtectControlGroups=true
|
|
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=pawletprofiled
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
WantedBy=cloud-init.target
|