# =====================================================================
# Detach the installation media from a base image.
#
#   systemctl start owuivm-detach@ubuntu.service
#
# WHY THIS IS A UNIT AND NOT A LINE IN THE DESKTOP TOOL
#
# The marker lives in /var/lib/owuivm/base, which the operator's account
# does not own. It could be made to - they were added to the owuivmadm
# group - but a unix group takes effect at the NEXT login, so a tool that
# depends on it fails confusingly for exactly as long as the session that
# installed it lasts. That trap has already been walked into once here.
#
# Going through a unit uses the mechanism that is already known to work
# for this operator: polkit, the same check that starts a maintenance
# boot. 50-owuivm.rules authorises both.
#
# Removing the marker is all it does. What it means is "this image is
# installed now": the launcher stops attaching the disc, and the machine
# boots itself.
# =====================================================================
[Unit]
Description=Detach installation media from the %i base image
ConditionPathExists=/var/lib/owuivm/base/%i.install

[Service]
Type=oneshot
User=owuivmadm
Group=owuivmadm
RemainAfterExit=no
ProtectSystem=strict
ReadWritePaths=/var/lib/owuivm/base
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes
ExecStart=/bin/rm -f /var/lib/owuivm/base/%i.install