run identity: /home/ubuntu/.local/state/g1vm/runs/20261025T032523Z-check-boot-kvm/disk.qcow2
  over /nix/store/axmxsd8j9hj2sq5m0d7idjbhjnazisr1-g1-virt-overlay-5.15.148-tegra/g1-virt-overlay.qcow2
  allow: /nix/store/p10gvabbjq0mvjcpl5yjk99qg4bhdwrq-g1vm-0.2.0/libexec/g1vm/allow/boot.allow
  102 changed, 1 undeclared (15 s in the g1-fs helper)

boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-ModemManager.service-Ys1ire
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-ModemManager.service-Ys1ire/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-bluetooth.service-QIbB60
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-bluetooth.service-QIbB60/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-colord.service-k6JuXv
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-colord.service-k6JuXv/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-fwupd.service-ISoiLX
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-fwupd.service-ISoiLX/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-haveged.service-9DlcOK
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-haveged.service-9DlcOK/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-power-profiles-daemon.service-eHa0JW
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-power-profiles-daemon.service-eHa0JW/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-switcheroo-control.service-4JQr87
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-switcheroo-control.service-4JQr87/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-logind.service-weN11s
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-logind.service-weN11s/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-resolved.service-ChRNZW
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-resolved.service-ChRNZW/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-timesyncd.service-oeRcjf
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-timesyncd.service-oeRcjf/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-upower.service-OxIIeh
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-upower.service-OxIIeh/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-ModemManager.service-a1ViU3
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-ModemManager.service-a1ViU3/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-bluetooth.service-22ebiZ
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-bluetooth.service-22ebiZ/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-colord.service-K7RXqG
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-colord.service-K7RXqG/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-fwupd.service-07nWeZ
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-fwupd.service-07nWeZ/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-haveged.service-WXVPJj
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-haveged.service-WXVPJj/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-power-profiles-daemon.service-cYrEY3
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-power-profiles-daemon.service-cYrEY3/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-switcheroo-control.service-uDuFI5
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-switcheroo-control.service-uDuFI5/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-logind.service-8HUCO2
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-logind.service-8HUCO2/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-resolved.service-Wd2MQ6
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-resolved.service-Wd2MQ6/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-timesyncd.service-Q69nlQ
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-timesyncd.service-Q69nlQ/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-upower.service-4DLqCH
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-upower.service-4DLqCH/tmp
UNDECLARED  - f 0:0 - /var/lib/snapd/maintenance.json
boot.allow:18  - f 1000:1000 - /tmp/gdm3-config-err-H18sL0
boot.allow:16  - s 0:0 - /tmp/.X11-unix/X0
boot.allow:17  - s 1000:1000 - /tmp/.ICE-unix/1747
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-ModemManager.service-XU9N8M/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-haveged.service-ZXtWCa/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-power-profiles-daemon.service-p5i3uG/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-switcheroo-control.service-JjFL5B/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-hostnamed.service-hOThoY/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-logind.service-Ro7xuj/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-resolved.service-Zr4Zds/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-timedated.service-Ft2K8K/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-timesyncd.service-tpDQMp/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-ModemManager.service-Zvubtd/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-haveged.service-BdF44G/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-power-profiles-daemon.service-lUUJg3/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-switcheroo-control.service-H98MB6/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-hostnamed.service-9SK5AI/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-logind.service-t19qVc/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-resolved.service-xLb8XR/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-timedated.service-BASuy6/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-timesyncd.service-hKTZks/tmp
boot.allow:14  d 700 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-ModemManager.service-XU9N8M
boot.allow:14  d 700 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-haveged.service-ZXtWCa
boot.allow:14  d 700 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-power-profiles-daemon.service-p5i3uG
boot.allow:14  d 700 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-switcheroo-control.service-JjFL5B
boot.allow:14  d 700 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-hostnamed.service-hOThoY
boot.allow:14  d 700 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-logind.service-Ro7xuj
boot.allow:14  d 700 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-resolved.service-Zr4Zds
boot.allow:14  d 700 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-timedated.service-Ft2K8K
boot.allow:14  d 700 0:0 - /tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-timesyncd.service-tpDQMp
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-ModemManager.service-Zvubtd
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-haveged.service-BdF44G
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-power-profiles-daemon.service-lUUJg3
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-switcheroo-control.service-H98MB6
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-hostnamed.service-9SK5AI
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-logind.service-t19qVc
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-resolved.service-xLb8XR
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-timedated.service-BASuy6
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-8cf5ef6ee6c64055bda3c9514415dedc-systemd-timesyncd.service-hKTZks
boot.allow:43  f 600 0:0 9271a4b1ba781f7d6fe99e28889956fab032214fef2e80ecb916c4a98dd6039a /var/lib/snapd/state.json
boot.allow:19  f 600 0:0 bb5001764ff00197d577e0269603dce57ec5cf6344602ad8ae89841936bb95ea /var/lib/systemd/random-seed
boot.allow:45  f 600 1000:1000 57fee26beb41daf2a77799a1dc7d07e12bc8132efa9287f8a2abe801842a0675 /home/unitree/.config/pulse/5dbfb12414a3456d9014d88183e338b1-device-volumes.tdb
boot.allow:28  f 640 0:4 03fa5005e04e57a0cb75af91d5b95cff4cff4842e2fa2aa02dbdcf2f67e83c07 /var/log/dmesg.4.gz
boot.allow:28  f 640 0:4 047824700caa5e07f740eebcda4a0d94623d9469faa2f8ae739eff05c7b952b0 /var/log/dmesg.3.gz
boot.allow:28  f 640 0:4 46fe80650c62f5b9ff48ad145e47f66173fd57e746ff3c6d1afa52491451cc30 /var/log/dmesg.1.gz
boot.allow:27  f 640 0:4 54faaf7b64832f46026e424ccdcf199019566b1169bee45d8df4120d941c88cc /var/log/dmesg
boot.allow:28  f 640 0:4 e094e1bb3f498ece558cfa1fc7ba9fd01347621dcf0f01150975a70ab3d2ff60 /var/log/dmesg.2.gz
boot.allow:28  f 640 0:4 f8b9a3505a9f9759a3a7591418945f35ff38b297c7cae1830ef796e552a41bd2 /var/log/dmesg.0
boot.allow:23  f 640 107:4 2b561e0834d4e359e16a70a43db65b2e9b05edfde9e3d5470fcd17fb804cf658 /var/log/kern.log
boot.allow:22  f 640 107:4 e3d36385a585fd6dfe21e6924478a2f7db3e0297896b57e69468ba1f45496a41 /var/log/syslog
boot.allow:24  f 640 107:4 ec102bb08d9fd7c41a8850214176f32e26b926327c552a01fe1ec8588b4dc8ca /var/log/auth.log
boot.allow:40  f 644 0:0 6a90a4491412d6ca5595ef938e307740356ebbf37d0d23e67a6866ce0a1a3cbc /var/lib/NetworkManager/timestamps
boot.allow:30  f 644 0:0 95bbb694ffd36ceb1adbc421aa73518a67ba9e8bf5f65f4d47327871bfba6efd /var/log/Xorg.0.log.old
boot.allow:20  f 644 0:0 9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa /var/lib/systemd/rfkill/wlan
boot.allow:29  f 644 0:0 b5c347c4d7e11e2f8e4944c0aa387029412d14ee9c5258118e1f47adfa86104e /var/log/Xorg.0.log
boot.allow:25  f 664 0:43 13a664427ae288ee994a3cd5bd80602be2bbdb856866c58a952fd726b00e5363 /var/log/wtmp
boot.allow:26  f 664 0:43 4739d70ad2417772be6301975ccdfe1cb50a3c752897e5d53edcba202e0bdc09 /var/log/lastlog

declared, not written in this run:
  boot.allow:32 /var/lib/gdm3/.config/pulse
  boot.allow:33 /var/lib/gdm3/.config/pulse/cookie
  boot.allow:34 /var/lib/gdm3/.config/pulse/5dbfb12414a3456d9014d88183e338b1-default-sink
  boot.allow:35 /var/lib/gdm3/.config/pulse/5dbfb12414a3456d9014d88183e338b1-default-source
  boot.allow:36 /var/lib/gdm3/.config/pulse/5dbfb12414a3456d9014d88183e338b1-device-volumes.tdb
  boot.allow:37 /var/lib/gdm3/.config/pulse/5dbfb12414a3456d9014d88183e338b1-card-database.tdb
  boot.allow:38 /var/lib/gdm3/.config/pulse/5dbfb12414a3456d9014d88183e338b1-stream-volumes.tdb
  boot.allow:41 /var/lib/NetworkManager/seen-bssids
  boot.allow:42 /var/lib/NetworkManager/internal-*.lease
  boot.allow:44 /var/cache/snapd/**
  boot.allow:47 /var/crash/_usr_sbin_nvbootctrl.*.crash
  boot.allow:48 /var/log/apport.log
  boot.allow:50 /var/spool/anacron/*
  boot.allow:51 /var/backups/dpkg.*
  boot.allow:52 /var/backups/apt.extended_states.*
  boot.allow:56 /var/cache/apt/archives/*.deb
  boot.allow:57 /var/cache/apt/*.bin
  boot.allow:58 /var/lib/apt/periodic/*
  boot.allow:59 /var/log/ubuntu-advantage.log
