https://umair-as.github.io/blog/tags/systemd/Recent content in Systemd on Umair's Systems NotebookHugoen-usTue, 21 Apr 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/rauc-pkcs11-tpm-streaming-sandbox/Tue, 21 Apr 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/rauc-pkcs11-tpm-streaming-sandbox/Switching RAUC’s streaming mTLS client key from a file path to a PKCS#11 URI produced a one-line error with no obvious cause. The real problem was not the module path, not the engine, and not a missing PIN — it was the sandbox user’s group membership and what tpm2-pkcs11 needs to initialise.https://umair-as.github.io/blog/posts/telegraf-yocto-recipe/Wed, 15 Apr 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/telegraf-yocto-recipe/No OE recipe for Telegraf exists upstream. What looked like a straightforward packaging task turned into a Go linker collision, a PIE/CGO conflict, and a credential problem that ruled out the obvious solution entirely.https://umair-as.github.io/blog/posts/otbr-systemd-hardening/Tue, 14 Apr 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/otbr-systemd-hardening/Part 1 got OTBR running as a non-root user with three capabilities. Part 2 covers the hardening block in the service file — what each directive does, why one had to be an exception, and how to use systemd-analyze security as a decision tool rather than a score to chase. Part 2 of 2.https://umair-as.github.io/blog/posts/running-otbr-as-non-root/Tue, 14 Apr 2026 00:00:00 +0000https://umair-as.github.io/blog/posts/running-otbr-as-non-root/OpenThread Border Router assumes it runs as root. Getting it down to a least-privilege non-root user means figuring out exactly what it needs — which turned out to be a source code problem, not a trial-and-error problem. Part 1 of 2.