From 8d6233d71feedd81e42007575f876b3e4d1c10c4 Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Wed, 8 Jul 2026 13:06:38 -0500 Subject: chore(maint): curate runtime perm drift out of the integrity count Reinstalling the owning packages reset these eight paths and the system re-drifted every one before the next -Qkk read: cupsd rewrites its three conf files mode 600, StateDirectory re-chowns /var/lib/passim on service start, tmpfiles re-groups /var/log/journal inside the reinstall transaction itself, /etc/ssl/private sits hardened below the packaged mode, and the utempter setgid helper carries ownership drift. They would count as integrity findings forever with no action that clears them. All eight are universal Arch runtime behavior, so they ship as qkk_known defaults rather than per-host curation. The utempter entry also silences a content change on that one binary, noted inline and accepted. I installed the TOML on both hosts; integrity now reads zero on each, with the real findings the metric surfaced along the way fixed for real (a stale hyprland.pc on both hosts, and /root sitting world-listable at 755 on velox, restored to the packaged 750). --- configs/maintenance-thresholds.toml | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'configs/maintenance-thresholds.toml') diff --git a/configs/maintenance-thresholds.toml b/configs/maintenance-thresholds.toml index 792a2d5..b522f88 100644 --- a/configs/maintenance-thresholds.toml +++ b/configs/maintenance-thresholds.toml @@ -172,4 +172,17 @@ entries = [ "/usr/lib/ghc-*/lib/package.conf.d/package.cache", # regenerated by ghc-pkg "/usr/lib/vlc/plugins/plugins.dat", # regenerated plugin cache "/etc/conf.d/pacman-contrib", # archsetup sets PACCACHE_ARGS + # Runtime perm/owner drift the system re-applies within seconds of a + # reinstall (verified on ratio 2026-07-08: reinstall reset these, the + # daemons re-drifted them before the next -Qkk): + "/etc/cups/classes.conf", # cupsd rewrites mode 600 + "/etc/cups/printers.conf", # (may carry device creds) + "/etc/cups/subscriptions.conf", + "/var/lib/passim*", # StateDirectory re-chowns + "/var/log/journal", # tmpfiles re-groups + "/etc/ssl/private", # hardened below packaged mode + "/usr/lib/utempter/utempter", # setgid-helper ownership; + # NOTE: also silences a + # content change on this + # one binary (accepted) ] -- cgit v1.2.3