Bug fixes

Signed-off-by: Tommy <contact@tommytran.io>
2025-11-04 11:08:35 +01:00 · 2024-01-15 08:49:56 -07:00
parent 2617245427
commit 57f6171df3
6 changed files with 77 additions and 53 deletions
--- a/Docker-Compose.ign
+++ b/Docker-Compose.ign
@@ -27,6 +27,7 @@
      "init_on_free=1",
      "pti=on",
      "vsyscall=none",
+      "ia32_emulation=0",
      "page_alloc.shuffle=1",
      "randomize_kstack_offset=on",
      "extra_latent_entropy",
@@ -171,17 +172,13 @@
      {
        "path": "/etc/systemd/system/debug-shell.service",
        "target": "/dev/null"
-      },
-      {
-        "path": "/etc/systemd/system/ctrl-alt-del.target",
-        "target": "/dev/null"
      }
    ]
  },
  "systemd": {
    "units": [
      {
-        "contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf\nExecStart=/usr/bin/systemctl restart chronyd\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/rpm-ostree install docker-ce docker-compose-plugin firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf | /usr/bin/tee /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf | /usr/bin/tee /etc/sysctl.d/30_silent-kernel-printk.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf | /usr/bin/tee /etc/sysctl.d/30_security-misc_kexec-disable.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/irqbalance.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf\nExecStart=/usr/bin/echo 'CtrlAltDelBurstAction=none' \u003e\u003e /etc/systemd/system.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
+        "contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf\nExecStart=/usr/bin/systemctl restart chronyd\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/rpm-ostree install docker-ce docker-compose-plugin firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf | /usr/bin/tee /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf | /usr/bin/tee /etc/sysctl.d/30_silent-kernel-printk.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf | /usr/bin/tee /etc/sysctl.d/30_security-misc_kexec-disable.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/irqbalance.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
        "enabled": true,
        "name": "postinst.service"
      },
--- a/Docker-Compose.yml
+++ b/Docker-Compose.yml
@@ -61,7 +61,6 @@ systemd:
        ExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d
        ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf
        ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf
-        ExecStart=/usr/bin/echo 'CtrlAltDelBurstAction=none' >> /etc/systemd/system.conf
        ExecStart=/usr/bin/systemctl disable systemd-resolved
        ExecStart=/usr/bin/touch /var/lib/%N.stamp
        ExecStart=/usr/bin/systemctl --no-block reboot
@@ -405,8 +404,6 @@ storage:
      target: /dev/null
    - path: /etc/systemd/system/debug-shell.service
      target: /dev/null
-    - path: /etc/systemd/system/ctrl-alt-del.target
-      target: /dev/null
 kernel_arguments:
  should_exist:
    - spectre_v2=on
@@ -432,6 +429,7 @@ kernel_arguments:
    - init_on_free=1
    - pti=on
    - vsyscall=none
+    - ia32_emulation=0
    - page_alloc.shuffle=1
    - randomize_kstack_offset=on
    - extra_latent_entropy
--- a/Generic.ign
+++ b/Generic.ign
@@ -27,6 +27,7 @@
      "init_on_free=1",
      "pti=on",
      "vsyscall=none",
+      "ia32_emulation=0",
      "page_alloc.shuffle=1",
      "randomize_kstack_offset=on",
      "extra_latent_entropy",
@@ -164,17 +165,13 @@
      {
        "path": "/etc/systemd/system/debug-shell.service",
        "target": "/dev/null"
-      },
-      {
-        "path": "/etc/systemd/system/ctrl-alt-del.target",
-        "target": "/dev/null"
      }
    ]
  },
  "systemd": {
    "units": [
      {
-        "contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf\nExecStart=/usr/bin/systemctl restart chronyd\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/rpm-ostree install docker-ce firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf -o /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf | /usr/bin/tee /etc/sysctl.d/30_silent-kernel-printk.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf | /usr/bin/tee /etc/sysctl.d/30_security-misc_kexec-disable.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/irqbalance.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf\nExecStart=/usr/bin/echo 'CtrlAltDelBurstAction=none' \u003e\u003e /etc/systemd/system.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
+        "contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf\nExecStart=/usr/bin/systemctl restart chronyd\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/rpm-ostree install docker-ce firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf -o /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf | /usr/bin/tee /etc/sysctl.d/30_silent-kernel-printk.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf | /usr/bin/tee /etc/sysctl.d/30_security-misc_kexec-disable.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/irqbalance.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
        "enabled": true,
        "name": "postinst.service"
      },
--- a/Generic.yml
+++ b/Generic.yml
@@ -61,7 +61,6 @@ systemd:
        ExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d
        ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf
        ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf
-        ExecStart=/usr/bin/echo 'CtrlAltDelBurstAction=none' >> /etc/systemd/system.conf
        ExecStart=/usr/bin/systemctl disable systemd-resolved
        ExecStart=/usr/bin/touch /var/lib/%N.stamp
        ExecStart=/usr/bin/systemctl --no-block reboot
@@ -387,8 +386,6 @@ storage:
      target: /dev/null
    - path: /etc/systemd/system/debug-shell.service
      target: /dev/null
-    - path: /etc/systemd/system/ctrl-alt-del.target
-      target: /dev/null
 kernel_arguments:
  should_exist:
    - spectre_v2=on
@@ -414,6 +411,7 @@ kernel_arguments:
    - init_on_free=1
    - pti=on
    - vsyscall=none
+    - ia32_emulation=0
    - page_alloc.shuffle=1
    - randomize_kstack_offset=on
    - extra_latent_entropy
--- a/UTM.ign
+++ b/UTM.ign
@@ -27,6 +27,7 @@
      "init_on_free=1",
      "pti=on",
      "vsyscall=none",
+      "ia32_emulation=0",
      "page_alloc.shuffle=1",
      "randomize_kstack_offset=on",
      "extra_latent_entropy",
@@ -150,25 +151,26 @@
      {
        "path": "/etc/systemd/system/debug-shell.service",
        "target": "/dev/null"
-      },
-      {
-        "path": "/etc/systemd/system/ctrl-alt-del.target",
-        "target": "/dev/null"
      }
    ]
  },
  "systemd": {
    "units": [
      {
-        "contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf\nExecStart=/usr/bin/echo \"allow 10.0.2.2/32\" \u003e\u003e /etc/chrony.conf\nExecStart=/usr/bin/systemctl restart chronyd\nExecStart=/usr/bin/rpm-ostree install firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf -o /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/lib/sysctl.d/sysctl.d/30_silent-kernel-printk.conf | /usr/bin/tee /etc/sysctl.d/30_silent-kernel-printk.conf\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/lib/sysctl.d/sysctl.d/30_security-misc_kexec-disable.conf | /usr/bin/tee /etc/sysctl.d/30_security-misc_kexec-disable.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/irqbalance.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d\nExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf\nExecStart=/usr/bin/sudo -u unpriv https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf\nExecStart=/usr/bin/echo 'CtrlAltDelBurstAction=none' \u003e\u003e /etc/systemd/system.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
+        "contents": "[Unit]\nDescription=Initial System Setup\n# We run after `systemd-machine-id-commit.service` to ensure that\n# `ConditionFirstBoot=true` services won't rerun on the next boot.\nAfter=systemd-machine-id-commit.service\nAfter=network-online.target\n# We run before `zincati.service` to avoid conflicting rpm-ostree\n# transactions.\nConditionPathExists=!/var/home/unpriv/%N.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nUser=unpriv\nWorkingDirectory=/var/home/unpriv\nExecStart=/usr/bin/sleep 5\nExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf\nExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf\nExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf\nExecStart=/usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf -o /var/home/unpriv/NetworkManager-brace.conf\nExecStart=/usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf -o /var/home/unpriv/irqbalance-brace.conf\nExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf\nExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf\nExecStart=/usr/bin/touch /var/home/unpriv/%N.stamp\n\n[Install]\nWantedBy=multi-user.target\n",
        "enabled": true,
        "name": "postinst.service"
      },
      {
-        "contents": "[Unit]\nDescription=Initial System Setup Part 2\n# We run this after the packages have been overlayed\nAfter=network-online.target\nConditionPathExists=!/var/lib/%N.stamp\nConditionPathExists=/var/lib/postinst.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/firewall-cmd --lockdown-on\n\n[Install]\nWantedBy=multi-user.target\n",
+        "contents": "[Unit]\nDescription=Initial System Setup Part 2\n# We run this after files have been downloaded\nAfter=postinst.service\nBefore=zincati.service\nConditionPathExists=!/var/lib/%N.stamp\nConditionPathExists=/var/home/unpriv/postinst.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/cp /var/home/unpriv/chrony.conf /etc/chrony.conf\nExecStart=/usr/bin/cp /var/home/unpriv/30_security-misc.conf /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/cp /var/home/unpriv/990-security-misc.conf /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/cp /var/home/unpriv/30_silent-kernel-printk.conf /etc/sysctl.d/30_silent-kernel-printk.conf\nExecStart=/usr/bin/cp /var/home/unpriv/30_security-misc_kexec-disable.conf /etc/sysctl.d/30_security-misc_kexec-disable.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d\nExecStart=/usr/bin/cp /var/home/unpriv/local.conf /etc/systemd/system/sshd.service.d/override.conf\nExecStart=/usr/bin/cp /var/home/unpriv/10-custom.conf /etc/ssh/sshd_config.d/10-custom.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d\nExecStart=/usr/bin/cp /var/home/unpriv/NetworkManager-brace.conf /etc/systemd/system/NetworkManager.service.d/99-brace.conf\nExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d\nExecStart=/usr/bin/cp /var/home/unpriv/irqbalance-brace.conf /etc/systemd/system/irqbalance.service.d/99-brace.conf\nExecStart=/usr/bin/systemctl restart chronyd\nExecStart=/usr/bin/rpm-ostree install firewalld qemu-guest-agent tuned unbound\nExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac\nExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth\nExecStart=/usr/bin/echo 'allow 10.0.2.2/32' \u003e\u003e /etc/chrony.conf\nExecStart=/usr/bin/sed -i 's/# install bluetooth/install bluetooth/g' /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sed -i 's/# install btusb/install btusb/g' /etc/modprobe.d/30_security-misc.conf\nExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf\nExecStart=/usr/bin/systemctl disable systemd-resolved\nExecStart=/usr/bin/touch /var/lib/%N.stamp\nExecStart=/usr/bin/systemctl --no-block reboot\n\n[Install]\nWantedBy=multi-user.target\n",
        "enabled": true,
        "name": "postinst2.service"
      },
+      {
+        "contents": "[Unit]\nDescription=Initial System Setup Part 3\n# We run this after the packages have been overlayed\nAfter=firewalld.service\nConditionPathExists=!/var/lib/%N.stamp\nConditionPathExists=/var/lib/postinst2.stamp\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/usr/bin/systemctl enable --now firewalld\nExecStart=/usr/bin/firewall-cmd --lockdown-on\nExecStart=/usr/bin/firewall-cmd --permanent --add-service=ntp\nExecStart=/usr/bin/firewall-cmd --reload\n\n[Install]\nWantedBy=multi-user.target\n",
+        "enabled": true,
+        "name": "postinst3.service"
+      },
      {
        "contents": "[Service]\nType=oneshot\nExecStart=/usr/sbin/setsebool container_use_cephfs off\nExecStart=/usr/sbin/setsebool virt_use_nfs off\nExecStart=/usr/sbin/setsebool virt_use_samba off\nRemainAfterExit=yes\n[Install]\nWantedBy=multi-user.target\n",
        "enabled": true,
--- a/UTM.yml
+++ b/UTM.yml
@@ -36,36 +36,24 @@ systemd:
        After=network-online.target
        # We run before `zincati.service` to avoid conflicting rpm-ostree
        # transactions.
-        Before=zincati.service
-        ConditionPathExists=!/var/lib/%N.stamp
+        ConditionPathExists=!/var/home/unpriv/%N.stamp

        [Service]
        Type=oneshot
        RemainAfterExit=yes
-        ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | /usr/bin/tee /etc/chrony.conf
-        ExecStart=/usr/bin/echo "allow 10.0.2.2/32" >> /etc/chrony.conf
-        ExecStart=/usr/bin/systemctl restart chronyd
-        ExecStart=/usr/bin/rpm-ostree install firewalld qemu-guest-agent tuned unbound
-        ExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac
-        ExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth
-        ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf | /usr/bin/tee /etc/modprobe.d/30_security-misc.conf
-        ExecStart=/usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf -o /etc/sysctl.d/990-security-misc.conf
-        ExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf
-        ExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf
-        ExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf
-        ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/lib/sysctl.d/sysctl.d/30_silent-kernel-printk.conf | /usr/bin/tee /etc/sysctl.d/30_silent-kernel-printk.conf
-        ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/Kicksecure/security-misc/master/lib/sysctl.d/sysctl.d/30_security-misc_kexec-disable.conf | /usr/bin/tee /etc/sysctl.d/30_security-misc_kexec-disable.conf
-        ExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d
-        ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/NetworkManager.service.d/99-brace.conf
-        ExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d
-        ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf | /usr/bin/tee /etc/systemd/system/irqbalance.service.d/99-brace.conf
-        ExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d
-        ExecStart=/usr/bin/sudo -u unpriv /usr/bin/curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf | /usr/bin/tee /etc/systemd/system/sshd.service.d/override.conf
-        ExecStart=/usr/bin/sudo -u unpriv https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf | /usr/bin/tee /etc/ssh/sshd_config.d/10-custom.conf
-        ExecStart=/usr/bin/echo 'CtrlAltDelBurstAction=none' >> /etc/systemd/system.conf
-        ExecStart=/usr/bin/systemctl disable systemd-resolved
-        ExecStart=/usr/bin/touch /var/lib/%N.stamp
-        ExecStart=/usr/bin/systemctl --no-block reboot
+        User=unpriv
+        WorkingDirectory=/var/home/unpriv
+        ExecStart=/usr/bin/sleep 5
+        ExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf
+        ExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/Kicksecure/security-misc/master/etc/modprobe.d/30_security-misc.conf
+        ExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/990-security-misc.conf
+        ExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_silent-kernel-printk.conf
+        ExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/Kicksecure/security-misc/master/usr/lib/sysctl.d/30_security-misc_kexec-disable.conf
+        ExecStart=/usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/NetworkManager.service.d/99-brace.conf -o /var/home/unpriv/NetworkManager-brace.conf
+        ExecStart=/usr/bin/curl https://gitlab.com/divested/brace/-/raw/master/brace/usr/lib/systemd/system/irqbalance.service.d/99-brace.conf -o /var/home/unpriv/irqbalance-brace.conf
+        ExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/sshd.service.d/local.conf
+        ExecStart=/usr/bin/curl -O https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/ssh/sshd_config/10-custom.conf
+        ExecStart=/usr/bin/touch /var/home/unpriv/%N.stamp

        [Install]
        WantedBy=multi-user.target
@@ -74,15 +62,60 @@ systemd:
      contents: |
        [Unit]
        Description=Initial System Setup Part 2
-        # We run this after the packages have been overlayed
-        After=network-online.target
+        # We run this after files have been downloaded
+        After=postinst.service
+        Before=zincati.service
        ConditionPathExists=!/var/lib/%N.stamp
-        ConditionPathExists=/var/lib/postinst.stamp
+        ConditionPathExists=/var/home/unpriv/postinst.stamp

        [Service]
        Type=oneshot
        RemainAfterExit=yes
+        ExecStart=/usr/bin/cp /var/home/unpriv/chrony.conf /etc/chrony.conf
+        ExecStart=/usr/bin/cp /var/home/unpriv/30_security-misc.conf /etc/modprobe.d/30_security-misc.conf
+        ExecStart=/usr/bin/cp /var/home/unpriv/990-security-misc.conf /etc/sysctl.d/990-security-misc.conf
+        ExecStart=/usr/bin/cp /var/home/unpriv/30_silent-kernel-printk.conf /etc/sysctl.d/30_silent-kernel-printk.conf
+        ExecStart=/usr/bin/cp /var/home/unpriv/30_security-misc_kexec-disable.conf /etc/sysctl.d/30_security-misc_kexec-disable.conf
+        ExecStart=/usr/bin/mkdir -p /etc/systemd/system/sshd.service.d
+        ExecStart=/usr/bin/cp /var/home/unpriv/local.conf /etc/systemd/system/sshd.service.d/override.conf
+        ExecStart=/usr/bin/cp /var/home/unpriv/10-custom.conf /etc/ssh/sshd_config.d/10-custom.conf
+        ExecStart=/usr/bin/mkdir -p /etc/systemd/system/NetworkManager.service.d
+        ExecStart=/usr/bin/cp /var/home/unpriv/NetworkManager-brace.conf /etc/systemd/system/NetworkManager.service.d/99-brace.conf
+        ExecStart=/usr/bin/mkdir -p /etc/systemd/system/irqbalance.service.d
+        ExecStart=/usr/bin/cp /var/home/unpriv/irqbalance-brace.conf /etc/systemd/system/irqbalance.service.d/99-brace.conf
+        ExecStart=/usr/bin/systemctl restart chronyd
+        ExecStart=/usr/bin/rpm-ostree install firewalld qemu-guest-agent tuned unbound
+        ExecStart=/usr/bin/rpm-ostree override remove cifs-utils containerd moby-engine runc samba-common-libs samba-client-libs libsmbclient libwbclient samba-common sssd-krb5-common sssd-ipa sssd-nfs-idmap sssd-ldap sssd-client sssd-ad sssd-common sssd-krb5 sssd-common-pac
+        ExecStart=/usr/bin/sed -i 's/nullok//g' /etc/pam.d/system-auth
+        ExecStart=/usr/bin/echo 'allow 10.0.2.2/32' >> /etc/chrony.conf
+        ExecStart=/usr/bin/sed -i 's/# install bluetooth/install bluetooth/g' /etc/modprobe.d/30_security-misc.conf
+        ExecStart=/usr/bin/sed -i 's/# install btusb/install btusb/g' /etc/modprobe.d/30_security-misc.conf
+        ExecStart=/usr/bin/sed -i 's/kernel.yama.ptrace_scope=2/kernel.yama.ptrace_scope=1/g' /etc/sysctl.d/990-security-misc.conf
+        ExecStart=/usr/bin/sed -i 's/net.ipv4.icmp_echo_ignore_all=1/net.ipv4.icmp_echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf
+        ExecStart=/usr/bin/sed -i 's/net.ipv6.icmp.echo_ignore_all=1/net.ipv6.icmp.echo_ignore_all=0/g' /etc/sysctl.d/990-security-misc.conf
+        ExecStart=/usr/bin/systemctl disable systemd-resolved
+        ExecStart=/usr/bin/touch /var/lib/%N.stamp
+        ExecStart=/usr/bin/systemctl --no-block reboot
+
+        [Install]
+        WantedBy=multi-user.target
+    - name: postinst3.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Initial System Setup Part 3
+        # We run this after the packages have been overlayed
+        After=firewalld.service
+        ConditionPathExists=!/var/lib/%N.stamp
+        ConditionPathExists=/var/lib/postinst2.stamp
+
+        [Service]
+        Type=oneshot
+        RemainAfterExit=yes
+        ExecStart=/usr/bin/systemctl enable --now firewalld
        ExecStart=/usr/bin/firewall-cmd --lockdown-on
+        ExecStart=/usr/bin/firewall-cmd --permanent --add-service=ntp
+        ExecStart=/usr/bin/firewall-cmd --reload

        [Install]
        WantedBy=multi-user.target
@@ -232,8 +265,6 @@ storage:
      target: /dev/null
    - path: /etc/systemd/system/debug-shell.service
      target: /dev/null
-    - path: /etc/systemd/system/ctrl-alt-del.target
-      target: /dev/null
 kernel_arguments:
  should_exist:
    - spectre_v2=on
@@ -259,6 +290,7 @@ kernel_arguments:
    - init_on_free=1
    - pti=on
    - vsyscall=none
+    - ia32_emulation=0
    - page_alloc.shuffle=1
    - randomize_kstack_offset=on
    - extra_latent_entropy