Require approval for new Thunderbolt accessories

etc/systemd/system/bolt.service.d/omarchy-authorization.conf

@@ -0,0 +1,3 @@
+[Service]
+# Runs before Bolt enumerates hardware, including D-Bus/udev activation.
+ExecStartPre=/usr/bin/omarchy-thunderbolt-authorization-admin guard

etc/systemd/system/omarchy-thunderbolt-authorization.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=Restore approved Thunderbolt devices and handle new approvals
+Wants=bolt.service
+After=bolt.service polkit.service
+ConditionPathExists=/etc/omarchy/thunderbolt-authorization.enabled
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/omarchy-thunderbolt-authorization-daemon
+RuntimeDirectory=omarchy-thunderbolt-authorization
+RuntimeDirectoryMode=0755
+Restart=on-failure
+RestartSec=2
+UMask=0077
+NoNewPrivileges=yes
+ProtectSystem=strict
+ReadWritePaths=/var/lib/omarchy/thunderbolt-authorization /run/lock
+ProtectHome=yes
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_UNIX
+
+[Install]
+WantedBy=multi-user.target