From 7b2a10b594d7ed0f463b78f29f1b30f8c1c6e64e Mon Sep 17 00:00:00 2001
From: ipv6 <ipv6@kf6.sh>
Date: Wed, 8 Apr 2026 10:28:59 -0500
Subject: [PATCH 1/3] Added tmpfiles.d/root.conf to set access permissions to
 root / dir

---
 tmpfiles.d/root.conf | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 tmpfiles.d/root.conf

diff --git a/tmpfiles.d/root.conf b/tmpfiles.d/root.conf
new file mode 100644
index 0000000000..9db0aaa92e
--- /dev/null
+++ b/tmpfiles.d/root.conf
@@ -0,0 +1,10 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+# See tmpfiles.d(5) for details.
+
+z / 555 - - -

From 15384f6e1f614bc7461f2dccac6a0ccdc04704d4 Mon Sep 17 00:00:00 2001
From: ipv6 <ipv6@kf6.sh>
Date: Wed, 8 Apr 2026 10:43:49 -0500
Subject: [PATCH 2/3] Added NEWS

---
 NEWS | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/NEWS b/NEWS
index c717a355ec..b8fbd7eb08 100644
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,9 @@ CHANGES WITH 261 in spe:
 
         New features:
 
+        * A new tmpfiles.d/root.conf has been added that sets permissions
+          on the root directory (/) to 0555
+
         * Networking to cloud IMDS services may be locked down for recognized
           clouds. This is recommended for secure installations, but typically
           conflicts with traditional IMDS clients such as cloud-init, which

From 5168e9eada5166343c8bfe11fba9eda17af99fdc Mon Sep 17 00:00:00 2001
From: ipv6 <ipv6@kf6.sh>
Date: Thu, 9 Apr 2026 14:04:16 -0500
Subject: [PATCH 3/3] added root.conf to meson.build

---
 tmpfiles.d/meson.build | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tmpfiles.d/meson.build b/tmpfiles.d/meson.build
index c8f9015b2e..83839dd627 100644
--- a/tmpfiles.d/meson.build
+++ b/tmpfiles.d/meson.build
@@ -6,6 +6,7 @@ endif
 
 files = [['README'                                  ],
          ['home.conf'                               ],
+         ['root.conf'                               ],
          ['journal-nocow.conf'                      ],
          ['portables.conf',       'ENABLE_PORTABLED'],
          ['systemd-network.conf', 'ENABLE_NETWORKD' ],