fix(kiosk): Skip X11 config on bare metal, disable service sandboxing

- X11 setup now exits early for bare metal (VM_TYPE=none) without
  creating config files - Intel/AMD/NVIDIA auto-detect perfectly
- Remove static fallback 10-modesetting.conf that caused conflicts
- Sanitize GPU_INFO in config comments to remove special chars
- Disable PrivateTmp and ProtectSystem for haproxy, metrics, threats
  services - causes Python symlink namespace errors on some kernels
- Add fix-namespace-errors.sh script for quick fixes on running systems

Fixes: X11 "no screens found" on Intel HD Graphics 630
Fixes: "Failed to set up mount namespacing" for Python services

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

image/build-live-usb.sh

@@ -1989,13 +1989,17 @@ case "$VM_TYPE" in
         modprobe virtio-gpu 2>/dev/null || true
         ;;
     none)
-        # Bare metal - use modesetting (works with most hardware)
-        DRIVER="modesetting"
-        log "Bare metal → modesetting driver"
+        # Bare metal - NO config needed! Intel/AMD/NVIDIA auto-detect perfectly.
+        # Creating custom configs often causes MORE problems than it solves.
+        log "Bare metal detected - skipping X11 config (auto-detection is best)"
         # Load common GPU drivers
         modprobe i915 2>/dev/null || true
         modprobe amdgpu 2>/dev/null || true
         modprobe nouveau 2>/dev/null || true
+        # Remove any existing custom configs that might cause issues
+        rm -f /etc/X11/xorg.conf.d/10-*.conf 2>/dev/null || true
+        log "X11 will auto-detect Intel/AMD/NVIDIA hardware"
+        exit 0
         ;;
     *)
         DRIVER="modesetting"
@@ -2003,12 +2007,14 @@ case "$VM_TYPE" in
         ;;
 esac
 
-# Write X11 configuration
+# Write X11 configuration (VMs only - bare metal exits above)
 mkdir -p /etc/X11/xorg.conf.d
+# Sanitize GPU_INFO to remove special characters that could break X11 config
+GPU_INFO_SAFE=$(echo "$GPU_INFO" | tr -d '<>()[]{}')
 cat > /etc/X11/xorg.conf.d/10-secubox-driver.conf <<XCONF
-# Auto-generated by secubox-x11-setup
+# Auto-generated by secubox-x11-setup (VM only)
 # VM Type: $VM_TYPE
-# GPU: $GPU_INFO
+# GPU: $GPU_INFO_SAFE
 # Driver: $DRIVER
 
 Section "Device"
@@ -2074,31 +2080,12 @@ SVCFILE
   ln -sf /etc/systemd/system/secubox-x11-setup.service \
     "${ROOTFS}/etc/systemd/system/multi-user.target.wants/secubox-x11-setup.service"
 
-  # Also create a fallback static config (in case service doesn't run)
-  cat > "${ROOTFS}/etc/X11/xorg.conf.d/10-modesetting.conf" <<'XCONF'
-# Fallback config - secubox-x11-setup.service creates a better one at boot
-Section "Device"
-    Identifier  "Default Device"
-    Driver      "modesetting"
-EndSection
+  # NO static fallback config - bare metal auto-detection works better without configs
+  # Only VMs need explicit driver configs, which secubox-x11-setup.service creates
+  # Ensure xorg.conf.d exists but is empty for bare metal
+  mkdir -p "${ROOTFS}/etc/X11/xorg.conf.d"
 
-Section "Screen"
-    Identifier  "Default Screen"
-    Device      "Default Device"
-    DefaultDepth 24
-    SubSection "Display"
-        Depth   24
-        Modes   "1024x768" "800x600" "640x480"
-    EndSubSection
-EndSection
-
-Section "ServerFlags"
-    Option "DontZap" "false"
-    Option "BlankTime" "0"
-EndSection
-XCONF
-
-  ok "X11 auto-detection setup created (VirtualBox VMSVGA → vmware driver)"
+  ok "X11 auto-detection setup created (VMs get explicit driver, bare metal auto-detects)"
 
   # Create kiosk user with UID 1000 (use /bin/bash for X11 su commands)
   if ! chroot "${ROOTFS}" id secubox-kiosk &>/dev/null; then

packages/secubox-haproxy/debian/secubox-haproxy.service

@@ -15,11 +15,12 @@ ExecStart=/usr/bin/python3 -m uvicorn api.main:app \
     --log-level warning
 Restart=on-failure
 RestartSec=5
-PrivateTmp=true
+# Sandboxing disabled - causes namespace errors with Python symlinks on some kernels
+# PrivateTmp=true
+# ProtectSystem=full
 NoNewPrivileges=true
 RuntimeDirectory=secubox
 RuntimeDirectoryMode=0775
-ProtectSystem=full
 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /etc/haproxy /run/haproxy
 
 [Install]

packages/secubox-metrics/debian/secubox-metrics.service

@@ -16,9 +16,10 @@ ExecStart=/usr/bin/python3 -m uvicorn api.main:app \
     --log-level warning
 Restart=on-failure
 RestartSec=5
-PrivateTmp=true
+# Sandboxing disabled - causes namespace errors with Python symlinks on some kernels
+# PrivateTmp=true
+# ProtectSystem=full
 NoNewPrivileges=true
-ProtectSystem=full
 ReadWritePaths=/run/secubox /tmp/secubox
 
 [Install]

packages/secubox-threats/systemd/secubox-threats.service

@@ -12,11 +12,12 @@ ExecStart=/usr/bin/python3 -m uvicorn api.main:app --uds /run/secubox/threats.so
 Restart=on-failure
 RestartSec=5
 UMask=0000
-PrivateTmp=true
+# Sandboxing disabled - causes namespace errors with Python symlinks on some kernels
+# PrivateTmp=true
+# ProtectSystem=full
 NoNewPrivileges=true
 RuntimeDirectory=secubox
 RuntimeDirectoryMode=0775
-ProtectSystem=full
 ReadWritePaths=/run/secubox /var/lib/secubox /etc/secubox /var/log/suricata /var/log/secubox
 
 [Install]

scripts/fix-namespace-errors.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+# ══════════════════════════════════════════════════════════════════
+# fix-namespace-errors.sh — Disable sandboxing that causes Python errors
+# Run this on real hardware when services fail with:
+#   "Failed to set up mount namespacing: /run/systemd/unit-root/usr/bin/python3"
+# ══════════════════════════════════════════════════════════════════
+set -euo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+log() { echo -e "${GREEN}[fix]${NC} $*"; }
+warn() { echo -e "${YELLOW}[warn]${NC} $*"; }
+err() { echo -e "${RED}[error]${NC} $*" >&2; }
+
+if [[ $EUID -ne 0 ]]; then
+    err "This script must be run as root"
+    exit 1
+fi
+
+log "Scanning for SecuBox services with sandboxing..."
+
+# Find all secubox services with PrivateTmp or ProtectSystem
+SERVICES=$(systemctl list-unit-files 'secubox-*.service' --no-legend | awk '{print $1}')
+
+FIXED=0
+for SERVICE in $SERVICES; do
+    # Get the service file path
+    SERVICE_FILE=$(systemctl show -p FragmentPath "$SERVICE" --value 2>/dev/null || true)
+    [[ -z "$SERVICE_FILE" ]] && continue
+    [[ ! -f "$SERVICE_FILE" ]] && continue
+
+    # Check if it has sandboxing options
+    if grep -qE '^(PrivateTmp|ProtectSystem)=' "$SERVICE_FILE" 2>/dev/null; then
+        # Create override directory
+        OVERRIDE_DIR="/etc/systemd/system/${SERVICE}.d"
+        mkdir -p "$OVERRIDE_DIR"
+
+        # Create override file
+        cat > "$OVERRIDE_DIR/no-sandbox.conf" <<'EOF'
+# Override to disable sandboxing that causes namespace errors with Python
+[Service]
+PrivateTmp=false
+ProtectSystem=false
+EOF
+
+        log "Created override for: $SERVICE"
+        ((FIXED++))
+    fi
+done
+
+if [[ $FIXED -gt 0 ]]; then
+    log "Fixed $FIXED services"
+    log "Reloading systemd..."
+    systemctl daemon-reload
+
+    log "Restarting failed services..."
+    systemctl reset-failed 'secubox-*' 2>/dev/null || true
+
+    # Restart specifically known problematic services
+    for svc in secubox-haproxy secubox-metrics secubox-threats; do
+        if systemctl is-enabled "$svc" &>/dev/null; then
+            log "Restarting $svc..."
+            systemctl restart "$svc" 2>/dev/null || warn "$svc failed to start"
+        fi
+    done
+
+    log "Done! Check status with: systemctl status 'secubox-*'"
+else
+    log "No services needed fixing"
+fi