ops: add user data isolation audit service

2026-07-11 01:09:57 +08:00
parent 8c0f2a8512
commit ed8967af7d
1 changed files with 17 additions and 0 deletions
@@ -0,0 +1,17 @@
+[Unit]
+Description=User data isolation audit guard
+Documentation=file:docs/security/user-data-isolation-redline.md
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+EnvironmentFile=-/etc/aios/user-data-isolation-audit.env
+ExecStart=/bin/sh -lc 'exec /usr/bin/python3 ${AIOS_MEMORY_GUARD_SCRIPT} audit --emit-safe-mode --json'
+TimeoutStartSec=120
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=full
+ReadWritePaths=/data/aios-gitops/runtime/state
+ReadOnlyPaths=/data/aios-gitops/runtime/memory