d$ /var/lib/virtiofs/hdd/storage 0755 0 0 -
d$ /var/lib/virtiofs/hdd/storage/media 0775 10017 10000 -
d$ /var/lib/virtiofs/hdd/storage/media/movies 0775 10017 10000 -
d$ /var/lib/virtiofs/hdd/storage/media/series 0775 10017 10000 -
d$ /var/lib/virtiofs/hdd/storage/media/music 0775 10017 10000 -
d$ /var/lib/virtiofs/hdd/storage/downloads 0775 10017 10000 -
d$ /var/lib/virtiofs/hdd/storage/torrents 0775 10017 10000 -
d$ /var/lib/virtiofs/hdd/storage/seed 0775 10017 10000 -
d$ /var/lib/virtiofs/hdd/storage/cross-seed 0775 10017 10000 -
d$ /var/lib/virtiofs/hdd/storage/import 0775 10017 10000 -
d$ /var/lib/virtiofs/ssd/radarr 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/radarr/config 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/radarr/config/tmp 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/radarr/config/xdg 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/sonarr 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/sonarr/config 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/sonarr/config/tmp 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/sonarr/config/xdg 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/lidarr 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/lidarr/config 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/lidarr/config/tmp 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/lidarr/config/xdg 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/prowlarr 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/prowlarr/config 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/prowlarr/config/tmp 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/prowlarr/config/xdg 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/jellyfin 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/jellyfin/config 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/cross-seed 0700 10017 10000 -
d$ /var/lib/virtiofs/ssd/cross-seed/config 0700 10017 10000 -

# Browser container displayed over waypipe. /run/seedbox/waypipe holds the
# sockets sshd forwards back to the waypipe client.
#
# Same permissions as /tmp, which is where waypipe puts these sockets by
# default, and for the same reasons: whoever opens the session has to be able to
# create one, and the browser -- running as a different, unprivileged uid -- has
# to be able to remove its own when waypipe shuts down. The sticky bit is what
# keeps that from becoming "anybody may delete anybody's socket". The sockets
# themselves are created 0600 by sshd (StreamLocalBindMask) and handed to a
# single uid by the shim.
d$ /run/seedbox 0755 root root -
d$ /run/seedbox/waypipe 1777 root root -
d$ /var/lib/quadlets/seedbox/librewolf 0700 10017 10000 -
d$ /var/lib/quadlets/seedbox/downloads 0755 10017 10000 -