ProtectKernelTunables, ProtectKernelModules and LockPersonality imply
NoNewPrivileges for a non-root unit, so sudo refused to start the helper
(hostname, reboot, network changes all failed). Guarded by a test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Chromium kiosk without a desktop for the Raspberry Pi 3, a Flask web
interface on port 8080 (kiosk, system and network management), a
restricted root helper, network changes with automatic rollback, a
healthcheck timer, install/update/uninstall scripts and a pi-gen image
build.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>