Installer: run the Runtime as a limited service on Linux and macOS #183

Part of #173 (isolation plan).

The installer and the source-home scripts start the Runtime as the user's own process with that user's full rights. Nothing limits what the Runtime or a compromised provider can do with the account.

Network exposure is part of the same limit. ipfs-provider runs a plain kubo init and only changes the gateway address (capsules/ipfs-provider/src/main.rs:690-731), so Kubo listens on all interfaces on port 4001 with mDNS and UPnP on and an RPC API without authorization. Carrier listens on 0.0.0.0:4433 with mDNS on (elastos/crates/elastos-server/src/carrier.rs:1293,1368,1387). gateway --public and serve bind 0.0.0.0 by default (gateway_cmd.rs:119, main.rs:115). The crosvm launch puts a token on the command line. The Browser TURN server listens on 0.0.0.0 with a permanent credential. The local CA is unconstrained, valid for 10 years, and the setup text asks for sudo to trust it (elastos-tls lib.rs:101, 266).

Done means

• On Linux the installer installs a systemd unit (system or user) that runs the Runtime with NoNewPrivileges, a private /tmp, a read-only view of the system and write access only to its data folder; on macOS it installs a launchd job with the equivalent limits that macOS allows.
• The installer may use root once, for example to create the system service or the Browser network device, after saying so and asking. At run time no binary is setuid or has file capabilities, nothing calls sudo, and Docker is not needed (Linux Browser launcher must not need passwordless sudo #165). Test: a scan of the installed files finds no setuid or capability binary, and the Runtime starts with sudo removed from PATH.
• The host command line (elastos home and other CLI commands) attaches to the Runtime under the service. The path is documented and tested.
• The Runtime binary location is writable for updates (inside the data folder or one explicit writable path). One update and one rollback pass under the unit.
• docs/INSTALL.md states what the service may and may not do.
• On Linux the Runtime runs as a system service under a dedicated account; on macOS as a user agent, and docs/INSTALL.md states that macOS cannot give the same separation.
• docs/INSTALL.md states plainly that code running as the Runtime account or as root can use the user's keys.
• The Runtime refuses to start when its data folder is readable by others, and creates every secret file 0600 atomically. Test: a 0755 data folder stops startup; the coordinates file is 0600 under umask 022.
• Devices on the network see only what the owner turned on. Kubo has no swarm listener unless sharing is on, with mDNS and UPnP off and API authorization set. Carrier mDNS follows the Discovery switch and is off by default. No command binds 0.0.0.0 unless the owner asks. Tests: an API call without the secret gets 403; with Discovery off nothing is broadcast; default and public modes bind 127.0.0.1.
• The VM token is passed by file descriptor or a 0600 file. Test: the token is not in the crosvm command line.
• TURN binds only the VM bridge, uses per-session credentials that expire, and refuses private peer addresses. Test.
• There is no unconstrained local CA and no step that needs sudo to trust one. Test: a certificate for example.com does not verify against any CA ElastOS creates.
• The supported way for a phone to reach a self-hosted Home is decided and documented (passkeys need a stable HTTPS origin).

Browser plan reconciliation — 2026-10-08

#288 consumes this issue's limited Runtime service/controller behavior; #165 supplies one-time Linux Browser network provisioning. User-session Engine/helpers stay within declared host authority and ordinary launch permissions. #131 supplies active Browser shutdown/crash/restart settlement, and #293 consumes named installed service/role receipts. Existing platform/review approval gates remain unchanged.

Plan for 0.8.0 (11 Oct, Anders: all items in 0.8.0)

• Slices: background service and binary in the data folder (feat/183-service); private data folder, secrets, listeners, Kubo, CA removal (feat/183-hardening). Linux Browser VM token/TURN items move with the Linux Browser train (Wrap third-party software as capsules served over Carrier; never download from other servers #217). Carrier local-network announcing (mDNS) stays on by default (decision 11 Oct, ease of use first): with relays off it is the only automatic way two Homes on the same Wi-Fi find each other after a restart. It shares only the Carrier node ID and local addresses; Chat still needs an approved contact and an encrypted, authenticated connection. INSTALL.md documents it and the off switch (fix(chat): keep Community and Direct delivery stable #309 owns the code). This replaces "Carrier mDNS follows the Discovery switch and is off by default".
• One shared installed proof with update: every capsule signed independently; updates replace only changed capsules #274 (test/080-install-update-proof): unit-started Home, update, Undo, uninstall, socket/file-mode checks on Mac, Linux and Jetson.
• Decision (Anders, 11 Oct): one mode, secure by default, ease of use and stability first. On Linux the Runtime runs as the user under a systemd user unit; macOS uses a user agent. No dedicated account; this replaces the item "system service under a dedicated account". Hiding the rest of the home folder needs user namespaces in a user unit, which can stop Home or the Linux Browser VM (KVM, vsock, nested namespaces) from starting, so it is not applied; INSTALL.md says so. The unit keeps NoNewPrivileges, UMask 0077 and similar settings that cannot block a start.
• Known limit (12 Oct): installer writes into <data>/bin are checked by device and inode under both writer locks, but not held by a directory descriptor. Only a process running as the same user that moves folders inside that user's own data folder could redirect them, and it could replace the Runtime directly anyway, so the shared transaction writer stays as it is for 0.8.0.