kandelo/MANIFEST at main · Automattic/kandelo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# kandelo rootfs manifest.
#
# Grammar: <path>  <type>  <mode>  [<uid>]  [<gid>]  [key=value ...]
# Types:   d dir, f file, l symlink, c char-device, b block-device
# Archive: archive  url=<path>  base=<prefix>  [fmode=] [dmode=] [uid=] [gid=]
#
# Files with type f and no src= pull content from images/rootfs/<path>.
# The mkrootfs builder refuses to silently drop on-disk files that
# aren't declared here, so every images/rootfs/* addition needs a line below.
#
# Ownership defaults to 0:0 (root). User programs observe these exact values
# through the mounted VFS image; the kernel's dynamic `/etc/mtab` exception
# does not shadow any manifest-owned path.
#
# The /dev tree is intentionally absent: the kernel intercepts
# /dev/{null,zero,full,random,urandom,tty,console,fb0,stdin,stdout,
# stderr,fd/N,pts/N,ptmx} synthetically, so declaring them here would
# either be redundant or actively misleading.

# ── Top-level system directories ───────────────────────────────────
/etc             d  0755  0  0
/tmp             d  1777  0  0
/home            d  0755  0  0
/root            d  0700  0  0
/srv             d  0755  0  0
/var             d  0755  0  0
/var/log         d  0755  0  0
/var/run         d  0755  0  0
/var/tmp         d  1777  0  0
/bin             d  0755  0  0
/usr             d  0755  0  0
/usr/bin         d  0755  0  0
/usr/share       d  0755  0  0
/usr/share/misc  d  0755  0  0
/etc/ssl         d  0755  0  0
/etc/ssl/certs   d  0755  0  0

# ── User home ──────────────────────────────────────────────────────
/home/user       d  0755  1000  1000

# ── /etc content (source: images/rootfs/etc/*) ────────────────────────────
# passwd/group/hosts live in rootfs.vfs, which is the source of truth
# for NSS-style files mounted at /.
/etc/passwd        f  0644  0  0
/etc/group         f  0644  0  0
/etc/hosts         f  0644  0  0
# shadow is mode 0640: world-unreadable per Linux convention. uid/gid
# stay at root since we have no separate "shadow" group.
/etc/shadow        f  0640  0  0
/etc/hostname      f  0644  0  0
/etc/resolv.conf   f  0644  0  0
/etc/nsswitch.conf f  0644  0  0
/etc/os-release    f  0644  0  0
/etc/profile       f  0644  0  0
/etc/motd          f  0644  0  0
# The rootfs file is the authoritative services database. Rootfs-derived
# images inherit it rather than rebuilding or synthesizing a second table.
/etc/services      f  0644  0  0

# OpenSSL was built with --openssldir=/etc/ssl. Static policy and public trust
# roots are ordinary image state, not kernel-synthesized files. The browser
# host may replace ca-certificates.crt with its per-session MITM root while
# leaving OpenSSL's compiled-in cert.pem path unchanged.
/etc/ssl/openssl.cnf                    f  0644  0  0
/etc/ssl/cert.pem                       f  0644  0  0
/etc/ssl/certs/ca-certificates.crt      f  0644  0  0  src=images/rootfs/etc/ssl/cert.pem

# ── Shells ─────────────────────────────────────────────────────────
# /bin/sh is provided by the generated package manifest as a symlink to
# /usr/bin/dash. The rootfs/bin/sh file is a legacy source-tree stub and is
# intentionally no longer declared here.