diff options
| author | Craig Jennings <c@cjennings.net> | 2026-07-08 13:06:38 -0500 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-07-08 13:06:38 -0500 |
| commit | 8d6233d71feedd81e42007575f876b3e4d1c10c4 (patch) | |
| tree | 3ff278eb9f6bce91126270523a55c29eb64bff96 /configs/maintenance-thresholds.toml | |
| parent | e8eff25043c12a7d30dc347be60ce516a5afd05d (diff) | |
| download | archsetup-8d6233d71feedd81e42007575f876b3e4d1c10c4.tar.gz archsetup-8d6233d71feedd81e42007575f876b3e4d1c10c4.zip | |
chore(maint): curate runtime perm drift out of the integrity count
Reinstalling the owning packages reset these eight paths and the system re-drifted every one before the next -Qkk read: cupsd rewrites its three conf files mode 600, StateDirectory re-chowns /var/lib/passim on service start, tmpfiles re-groups /var/log/journal inside the reinstall transaction itself, /etc/ssl/private sits hardened below the packaged mode, and the utempter setgid helper carries ownership drift. They would count as integrity findings forever with no action that clears them.
All eight are universal Arch runtime behavior, so they ship as qkk_known defaults rather than per-host curation. The utempter entry also silences a content change on that one binary, noted inline and accepted. I installed the TOML on both hosts; integrity now reads zero on each, with the real findings the metric surfaced along the way fixed for real (a stale hyprland.pc on both hosts, and /root sitting world-listable at 755 on velox, restored to the packaged 750).
Diffstat (limited to 'configs/maintenance-thresholds.toml')
| -rw-r--r-- | configs/maintenance-thresholds.toml | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/configs/maintenance-thresholds.toml b/configs/maintenance-thresholds.toml index 792a2d5..b522f88 100644 --- a/configs/maintenance-thresholds.toml +++ b/configs/maintenance-thresholds.toml @@ -172,4 +172,17 @@ entries = [ "/usr/lib/ghc-*/lib/package.conf.d/package.cache", # regenerated by ghc-pkg "/usr/lib/vlc/plugins/plugins.dat", # regenerated plugin cache "/etc/conf.d/pacman-contrib", # archsetup sets PACCACHE_ARGS + # Runtime perm/owner drift the system re-applies within seconds of a + # reinstall (verified on ratio 2026-07-08: reinstall reset these, the + # daemons re-drifted them before the next -Qkk): + "/etc/cups/classes.conf", # cupsd rewrites mode 600 + "/etc/cups/printers.conf", # (may carry device creds) + "/etc/cups/subscriptions.conf", + "/var/lib/passim*", # StateDirectory re-chowns + "/var/log/journal", # tmpfiles re-groups + "/etc/ssl/private", # hardened below packaged mode + "/usr/lib/utempter/utempter", # setgid-helper ownership; + # NOTE: also silences a + # content change on this + # one binary (accepted) ] |