run identity: /home/ubuntu/.local/state/g1vm/runs/20261024T235828Z-check-devices-kvm/disk.qcow2
  over /nix/store/axmxsd8j9hj2sq5m0d7idjbhjnazisr1-g1-virt-overlay-5.15.148-tegra/g1-virt-overlay.qcow2
  allow: /nix/store/10yqgrzxyidp3wb8shz5akb6y75pcd58-g1vm-0.2.0/libexec/g1vm/allow/boot.allow /nix/store/10yqgrzxyidp3wb8shz5akb6y75pcd58-g1vm-0.2.0/libexec/g1vm/allow/devices.allow /nix/store/10yqgrzxyidp3wb8shz5akb6y75pcd58-g1vm-0.2.0/libexec/g1vm/allow/site.allow /nix/store/10yqgrzxyidp3wb8shz5akb6y75pcd58-g1vm-0.2.0/libexec/g1vm/allow/dds.allow
  115 changed, 0 undeclared (11 s in the g1-fs helper)

boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-ModemManager.service-Ys1ire
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-ModemManager.service-Ys1ire/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-bluetooth.service-QIbB60
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-bluetooth.service-QIbB60/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-colord.service-k6JuXv
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-colord.service-k6JuXv/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-fwupd.service-ISoiLX
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-fwupd.service-ISoiLX/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-haveged.service-9DlcOK
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-haveged.service-9DlcOK/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-power-profiles-daemon.service-eHa0JW
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-power-profiles-daemon.service-eHa0JW/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-switcheroo-control.service-4JQr87
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-switcheroo-control.service-4JQr87/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-logind.service-weN11s
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-logind.service-weN11s/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-resolved.service-ChRNZW
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-resolved.service-ChRNZW/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-timesyncd.service-oeRcjf
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-timesyncd.service-oeRcjf/tmp
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-upower.service-OxIIeh
boot.allow:14  - d 0:0 - /tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-upower.service-OxIIeh/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-ModemManager.service-a1ViU3
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-ModemManager.service-a1ViU3/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-bluetooth.service-22ebiZ
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-bluetooth.service-22ebiZ/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-colord.service-K7RXqG
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-colord.service-K7RXqG/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-fwupd.service-07nWeZ
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-fwupd.service-07nWeZ/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-haveged.service-WXVPJj
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-haveged.service-WXVPJj/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-power-profiles-daemon.service-cYrEY3
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-power-profiles-daemon.service-cYrEY3/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-switcheroo-control.service-uDuFI5
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-switcheroo-control.service-uDuFI5/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-logind.service-8HUCO2
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-logind.service-8HUCO2/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-resolved.service-Wd2MQ6
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-resolved.service-Wd2MQ6/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-timesyncd.service-Q69nlQ
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-systemd-timesyncd.service-Q69nlQ/tmp
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-upower.service-4DLqCH
boot.allow:15  - d 0:0 - /var/tmp/systemd-private-073050aa1f9644b9a66b0a7c2ac38362-upower.service-4DLqCH/tmp
boot.allow:18  - f 1000:1000 - /tmp/gdm3-config-err-H18sL0
boot.allow:16  - s 0:0 - /tmp/.X11-unix/X0
boot.allow:17  - s 1000:1000 - /tmp/.ICE-unix/1747
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-ModemManager.service-niLALY/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-haveged.service-ZAYZRD/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-power-profiles-daemon.service-7ie4Bx/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-switcheroo-control.service-TEfSsG/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-systemd-logind.service-pnEjQ6/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-systemd-resolved.service-dzmUlU/tmp
boot.allow:14  d 1777 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-systemd-timesyncd.service-Tfxhic/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-ModemManager.service-bvH8mq/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-haveged.service-bTDHlo/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-power-profiles-daemon.service-vB0I78/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-switcheroo-control.service-ZIs2VW/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-systemd-logind.service-DCo23w/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-systemd-resolved.service-tpeic2/tmp
boot.allow:15  d 1777 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-systemd-timesyncd.service-PfML7b/tmp
boot.allow:14  d 700 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-ModemManager.service-niLALY
boot.allow:14  d 700 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-haveged.service-ZAYZRD
boot.allow:14  d 700 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-power-profiles-daemon.service-7ie4Bx
boot.allow:14  d 700 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-switcheroo-control.service-TEfSsG
boot.allow:14  d 700 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-systemd-logind.service-pnEjQ6
boot.allow:14  d 700 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-systemd-resolved.service-dzmUlU
boot.allow:14  d 700 0:0 - /tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-systemd-timesyncd.service-Tfxhic
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-ModemManager.service-bvH8mq
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-haveged.service-bTDHlo
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-power-profiles-daemon.service-vB0I78
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-switcheroo-control.service-ZIs2VW
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-systemd-logind.service-DCo23w
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-systemd-resolved.service-tpeic2
boot.allow:15  d 700 0:0 - /var/tmp/systemd-private-c9b5faf53b10413993ca9f669b25d350-systemd-timesyncd.service-PfML7b
devices.allow:4  d 775 1000:1000 - /tmp/g1vm
devices.allow:4  f 444 1000:1000 814fae1a1d213a32d42be6e6a02076e0139cff8332866d2b624f521cf9231453 /tmp/g1vm/probe.cpp
devices.allow:4  f 444 1000:1000 d4fa2a6255dc222bf8f790ccaf4c92668dd3d7d2362d8093c83f72048a53a750 /tmp/g1vm/cap.py
devices.allow:4  f 555 1000:1000 57968d9d17ed1e532963a1c74f929a51ade4c144350ee0825be7de85503d1430 /tmp/g1vm/tcpdump
devices.allow:4  f 555 1000:1000 a91a3fe4ae5324b9d747c78bab988bb801fa88cf514e11c4278c3f8c9854c72e /tmp/g1vm/fake-pc
boot.allow:35  f 600 0:0 9271a4b1ba781f7d6fe99e28889956fab032214fef2e80ecb916c4a98dd6039a /var/lib/snapd/state.json
boot.allow:19  f 600 0:0 d91403f4bc6788eb9f2a923160e496ac58b21312d2456e4423c3632162149d0d /var/lib/systemd/random-seed
site.allow:5  f 600 0:0 e7c632202555c55326bc396ff3a89af746cc3c3bd6452bee0a4704f12764be7a /etc/NetworkManager/system-connections/site-wifi.nmconnection
boot.allow:37  f 600 1000:1000 57fee26beb41daf2a77799a1dc7d07e12bc8132efa9287f8a2abe801842a0675 /home/unitree/.config/pulse/5dbfb12414a3456d9014d88183e338b1-device-volumes.tdb
boot.allow:28  f 640 0:4 03fa5005e04e57a0cb75af91d5b95cff4cff4842e2fa2aa02dbdcf2f67e83c07 /var/log/dmesg.4.gz
boot.allow:28  f 640 0:4 047824700caa5e07f740eebcda4a0d94623d9469faa2f8ae739eff05c7b952b0 /var/log/dmesg.3.gz
boot.allow:28  f 640 0:4 46fe80650c62f5b9ff48ad145e47f66173fd57e746ff3c6d1afa52491451cc30 /var/log/dmesg.1.gz
boot.allow:27  f 640 0:4 933a56dd9a0dcc1e3a2a90bb242b3aa3653929fad2def9fc8e930d992e5d3c40 /var/log/dmesg
boot.allow:28  f 640 0:4 e094e1bb3f498ece558cfa1fc7ba9fd01347621dcf0f01150975a70ab3d2ff60 /var/log/dmesg.2.gz
boot.allow:28  f 640 0:4 f8b9a3505a9f9759a3a7591418945f35ff38b297c7cae1830ef796e552a41bd2 /var/log/dmesg.0
boot.allow:24  f 640 107:4 725afe6928fbb539efa0ea2e7d85c68aeeb5052af34aea20cb5542938d5c988f /var/log/auth.log
boot.allow:22  f 640 107:4 a3c0b864a2fa9f052ba9785fc6e9eec100e581754afbbcc6bd8f575a208fa228 /var/log/syslog
boot.allow:23  f 640 107:4 d034699efd56748aa13895850228ff1f102ebc8240a6ea796720241567009cd1 /var/log/kern.log
devices.allow:4  f 644 0:0 05239dd13e83eda1764da554d36afee406a8c3a1c2acf130b445ce687b5b46a0 /tmp/g1vm/tcpdump.err
boot.allow:30  f 644 0:0 05f058e6177a490ee67517e656e0310d051fe5f4ad32bf937f461d70d6427262 /var/log/Xorg.0.log.old
devices.allow:7  f 644 0:0 16cd6b34d54dae9bc972c5ce1c52ddecd666de5af247c72b1c7d3bd55c2d343d /etc/udev/rules.d/80-can-gripper.rules
devices.allow:4  f 644 0:0 1745412b330da87bcdae7d9f63f8a36fae3940adec22294446b5cc02b1bbc49e /tmp/g1vm/tcpdump.txt
devices.allow:4  f 644 0:0 4e8b5a02b430cc19e09cb7e4d2c19d631a65c32d5124ce6289432185d24056c3 /tmp/g1vm/probe.json
devices.allow:4  f 644 0:0 6d28d6ee7e4c9af661062f7389163e6ae7e32cf87dbb54e0332a582b9d4ba5db /tmp/g1vm/slots.txt
boot.allow:34  f 644 0:0 7694bb872f3f3d5d8977e74071b5060e264cdb4bea0f2cb57d40013d64d24c4b /var/lib/NetworkManager/internal-a13d3012-d375-395a-a87d-5e02b5e2c3fd-enp0s1.lease
boot.allow:29  f 644 0:0 8c89a3981f6b70a45d1c49b078e17599847fa281251ba51172b1ef70f3b606b1 /var/log/Xorg.0.log
boot.allow:33  f 644 0:0 9990cfd2e7bad52148a5943abb5cc97516cdbd2c3d3c914fedebe3dbf9054b1e /var/lib/NetworkManager/seen-bssids
boot.allow:20  f 644 0:0 9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa /var/lib/systemd/rfkill/wlan
boot.allow:32  f 644 0:0 aadaab8923b2717c54edbbc55c5a27d9422876ebdef01acd4ed8b7803afcfe44 /var/lib/NetworkManager/timestamps
devices.allow:4  f 644 0:0 d6d51c7e190f803301d395aac82a514ce0b1cedd8e49fccb434ae406db16c79a /tmp/g1vm/cap-2.1.3.txt
devices.allow:4  f 644 0:0 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 /tmp/g1vm/probe.err
devices.allow:4  f 644 0:0 f9d2a3a81d710bca7a590e01e9e2b8345bf164eb5762a3d9852ca012617bc7d1 /tmp/g1vm/cap-2.1.4.txt
devices.allow:4  f 644 1000:1000 16cd6b34d54dae9bc972c5ce1c52ddecd666de5af247c72b1c7d3bd55c2d343d /tmp/g1vm/80-can-gripper.rules
devices.allow:4  f 644 1000:1000 7a8b7e7ee911c521cf0c25c24382d195e79e23c32ecb39d881b932567ac036eb /tmp/g1vm/site.sh
devices.allow:4  f 644 1000:1000 8f33cfdc1fd66317cc8f7343bd6c762382bdde11138db96098b860363ca43de4 /tmp/g1vm/nic.sh
devices.allow:4  f 644 1000:1000 8f6e88575118d77535385bcd3e38a38057a110cc545f98064da08c0f7c507465 /tmp/g1vm/gripper_check.py
devices.allow:4  f 644 1000:1000 bbf072ffb5e3057287fd3458798c41f5e4a4a95cf0662687fe37c1bdb1dbe786 /tmp/g1vm/run.sh
devices.allow:4  f 644 1000:1000 d3e7d7c1e01c00c30b8884ab02e525251115552a74c086f1edc0e411f6799e4a /tmp/g1vm/devices.sh
boot.allow:25  f 664 0:43 6d50bab82ff6db3869a3b7a0d10046b4f53528887245e9afa918923dc54cc2d3 /var/log/wtmp
devices.allow:4  f 775 1000:1000 519ae20f993112399570a58ff698106979c606a4cb71d8e85452c69c38239239 /tmp/g1vm/pc2-probe

declared, not written in this run:
  boot.allow:26 /var/log/lastlog
  boot.allow:36 /var/cache/snapd/**
  boot.allow:39 /var/crash/_usr_sbin_nvbootctrl.*.crash
  boot.allow:40 /var/log/apport.log
  boot.allow:42 /var/spool/anacron/*
  boot.allow:43 /var/backups/dpkg.*
  boot.allow:44 /var/backups/apt.extended_states.*
  boot.allow:48 /var/cache/apt/**
  boot.allow:49 /var/lib/apt/lists/**
  boot.allow:50 /var/lib/apt/periodic/*
  boot.allow:51 /var/lib/update-notifier/**
  boot.allow:52 /var/cache/swcatalog/**
  boot.allow:53 /var/lib/swcatalog/**
  boot.allow:54 /var/lib/ubuntu-advantage/**
  boot.allow:55 /var/log/ubuntu-advantage.log
  devices.allow:8 f 644 0:0 07da03c72e1ae73c775ea0225bc0b4796382db77c492cd8219f6c1b24fd8a579 /etc/udev/rules.d/80-can-gripper.rules
  site.allow:3 /tmp/g1vm/**
  dds.allow:3 /tmp/g1vm/**
