Initial Commit

2026-09-15 15:24:03 -04:00
commit 4dc7086e7e
605 changed files with 101380 additions and 0 deletions
@@ -0,0 +1,34 @@
+# =====================================================================
+# The operator's own verb: thaw a base image.
+#
+#   systemctl start owuivm-thaw@ubuntu.service
+#
+# One chmod, in a directory the operator's account does not own. It goes
+# through a unit for the same reason owuivm-detach@ does: polkit is the
+# check that already works for this operator, and a unix group would
+# only take effect at their next login.
+#
+# Whether an image is frozen is the owner write bit and nothing else, so
+# these two verbs are the whole mechanism and `ls -l` is the whole
+# report. Neither will run while the machine is up - qemu already holds
+# the file open, so a chmod then would change what the mode SAYS without
+# changing anything about what is happening.
+# =====================================================================
+[Unit]
+Description=Thaw the %i base image
+ConditionPathExists=/var/lib/owuivm/base/%i.qcow2
+
+[Service]
+Type=oneshot
+User=owuivmadm
+Group=owuivmadm
+RemainAfterExit=no
+# The same umask the maintenance unit uses, so the checksum manifest this
+# writes keeps the mode it has always had rather than a default 0644.
+UMask=0007
+ProtectSystem=strict
+ReadWritePaths=/var/lib/owuivm/base
+ProtectHome=yes
+PrivateTmp=yes
+NoNewPrivileges=yes
+ExecStart=/usr/local/libexec/owuivm-maint-prepare %i thaw