diff options
Diffstat (limited to 'configs/maintenance-thresholds.toml')
| -rw-r--r-- | configs/maintenance-thresholds.toml | 26 |
1 files changed, 22 insertions, 4 deletions
diff --git a/configs/maintenance-thresholds.toml b/configs/maintenance-thresholds.toml index 92ca048..c14eaec 100644 --- a/configs/maintenance-thresholds.toml +++ b/configs/maintenance-thresholds.toml @@ -50,9 +50,9 @@ cache_warn_gb = 20 # above keep-3 saturation (~17-19GB on ratio # fires within ~2 months if the paccache timer dies keyring_warn_days = 60 # stale archlinux-keyring silently breaks updates -[security] -cve_min_warn = "high" # arch-audit severity floor that warns (the - # constant Unknown/Low tail is background) +# [security] cve_min_warn retired 2026-07-08: the cve grade now keys on +# actionability (a fixed release exists and isn't installed), not severity. +# Unfixable advisories are informational and never warn. [updates] pending_warn = 50 # "a lot" — reddens the strip border @@ -81,7 +81,10 @@ expected_timers_extra = [] app_log_warn_days = 7 # log-cleanup cron should hold ~7 days journal_digest_top = 10 # groups shown in the journal digest journal_disk_warn_gb = 2 # journald footprint before vacuum suggested -coredump_window_days = 14 # dumps older than this age out of the count +coredump_window_days = 14 # forensic window (matches systemd's 2w + # tmpfiles aging): the value/grade counts + # corefiles PAST it — CLEAR's reclaim set; + # recent crashes are digest-visible only [memory] used_warn_pct = 90 # 1 - available/total (reclaimable-aware) @@ -169,4 +172,19 @@ entries = [ "/usr/lib/ghc-*/lib/package.conf.d/package.cache", # regenerated by ghc-pkg "/usr/lib/vlc/plugins/plugins.dat", # regenerated plugin cache "/etc/conf.d/pacman-contrib", # archsetup sets PACCACHE_ARGS + # Runtime perm/owner drift the system re-applies within seconds of a + # reinstall (verified on ratio 2026-07-08: reinstall reset these, the + # daemons re-drifted them before the next -Qkk): + "/etc/cups/classes.conf", # cupsd rewrites mode 600 + "/etc/cups/printers.conf", # (may carry device creds) + "/etc/cups/subscriptions.conf", + "/var/lib/passim*", # StateDirectory re-chowns + "/var/log/journal", # tmpfiles re-groups + # /etc/ssl/private deliberately NOT here: both hosts had it world-listable + # (755 vs packaged 700) — a real misconfig the metric caught. pacman warns + # but never resets existing dir perms; fixed by chmod 2026-07-08. + "/usr/lib/utempter/utempter", # setgid-helper ownership; + # NOTE: also silences a + # content change on this + # one binary (accepted) ] |