mwiegand 06ae84fbe4 fix(deploy): script-sandbox helper — UID drop via systemd-run, --unshare-user-try, /etc/alternatives ... Smoke testing on the test host revealed three issues with the helper as shipped: 1. bwrap 0.11+ rejects --uid without --unshare-user. Switching the UID drop from inside bwrap to systemd-run (--uid=l4d2-sandbox --gid=l4d2-sandbox) sidesteps the userns UID-mapping headaches and keeps file ownership on the bind-mounted /overlay matching l4d2-sandbox on the host (which the wipe path relies on). 2. bwrap running as an unprivileged uid still needs a user namespace to set up its mount-namespace bind-mounts. Adding --unshare-user-try gives it the userns context when needed and is a no-op otherwise. 3. /etc/alternatives wasn't bind-mounted, so symlinked tools like /usr/bin/awk -> /etc/alternatives/awk fell over inside the sandbox. Adds the ro-bind. Also: the helper now chowns the overlay dir to l4d2-sandbox before bwrap (idempotent — needed because the web app creates the dir as left4me), and the deploy script chmods /var/lib/left4me to 0711 so l4d2-sandbox can traverse to the bind-mount source. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-08 16:12:46 +02:00
..
etc/sudoers.d	feat(deploy): left4me-script-sandbox helper + sudoers fragment	2026-05-08 15:53:21 +02:00
usr/local	fix(deploy): script-sandbox helper — UID drop via systemd-run, --unshare-user-try, /etc/alternatives	2026-05-08 16:12:46 +02:00