# =====================================================================
# The operator's own verb: thaw a base image.
#
#   systemctl start owuivm-thaw@ubuntu.service
#
# One chmod, in a directory the operator's account does not own. It goes
# through a unit for the same reason owuivm-detach@ does: polkit is the
# check that already works for this operator, and a unix group would
# only take effect at their next login.
#
# Whether an image is frozen is the owner write bit and nothing else, so
# these two verbs are the whole mechanism and `ls -l` is the whole
# report. Neither will run while the machine is up - qemu already holds
# the file open, so a chmod then would change what the mode SAYS without
# changing anything about what is happening.
# =====================================================================
[Unit]
Description=Thaw the %i base image
ConditionPathExists=/var/lib/owuivm/base/%i.qcow2

[Service]
Type=oneshot
User=owuivmadm
Group=owuivmadm
RemainAfterExit=no
# The same umask the maintenance unit uses, so the checksum manifest this
# writes keeps the mode it has always had rather than a default 0644.
UMask=0007
ProtectSystem=strict
ReadWritePaths=/var/lib/owuivm/base
ProtectHome=yes
PrivateTmp=yes
NoNewPrivileges=yes
ExecStart=/usr/local/libexec/owuivm-maint-prepare %i thaw