A ceiling narrows, and never grants

On a machine you do not hold root on, an administrator writes a ceiling: the widest policy that host allows. Whatever a package asks for, and whatever the owner of an installation allows it, is held to that file.

A ceiling is a permission set, written the same way a package writes its request. That is what makes people misread it, so take this line first: a ceiling is met by intersection. It removes. It cannot add.

Writing true in a ceiling grants nothing

A ceiling containing "deviceDri": true gives no package the graphics device. It says the host does not stand in the way of a package that asks for it, which is what leaving the key out would have said too. An application that asks for nothing keeps nothing, under a permissive ceiling and a strict one alike.

The other half of the file is the useful one. "network": false closes the network for everything on the host, whoever published it. A filesystem list in the ceiling holds every filesystem request down to what that list allows: name read-only access to the download directory, and a package asking for the whole home directory becomes an application that reads one folder.

A key it does not name is a key it does not decide

A ceiling that closes the session bus and the network says nothing about audio, devices or the accessibility bus, and applications keep whatever they asked for there. Write down the decisions you want to make. Everything else stays where it was.

So a ceiling is not a description of what runs. It is one of three inputs: the package asks, the owner of the installation may replace that request outright, and the ceiling narrows what survived.

Signatures are a separate question

The ceiling treats a package nobody signed and a package from an approved publisher exactly alike. Approving a publisher does not grant whatever they decide to ask for in a later release, which is why the two controls live in two files.

Use the playground beside this text to set a manifest, an owner override and a ceiling against each other and read what survives all three. Managed deployment is the reference behind this lesson.