# /run/owuivm is where every session's sockets and its OVMF vars live,
# and where a maintenance boot puts its own. Group-writable because three
# users legitimately create things here: vmd (sessions), qemu (sockets),
# and owuivmadm (maintenance). 0770: nothing else on this host has any
# business reading a QMP socket path, and QMP is a capability.
d /run/owuivm 0770 owuivmd owuivm -

# The maintenance console's socket. Separate from /run/owuivm because
# that one is owned by vmd and deliberately unreadable to anyone else,
# while this one has to be reachable by the operator's desktop session.
# setgid, with the OPERATOR as the group, so the socket qemu creates
# inside it is group-owned by the person who needs to connect to it.
# install.sh substitutes @OPERATOR@ for whoever ran it.
d /run/owuivm-maint 2770 owuivmadm @OPERATOR@ -