Add profile stamping as active migration

client/internal/profilemanager/profilemanager.go

@@ -32,6 +32,10 @@ type Profile struct {
 	Path     string
 	IsActive bool
 	Owners   []ipcauth.Principal
+	// LegacyUserDir is the sanitized username of the per-username directory the
+	// profile was found in, empty for the profiles.v1 directory and for the
+	// default profile. It is the only legacy evidence of profile ownership.
+	LegacyUserDir string
 }
 
 // AccessibleBy reports whether a kernel-attested caller may address this
@@ -43,9 +47,11 @@ func (p *Profile) AccessibleBy(id ipcauth.Identity) bool {
 	if ipcauth.IsPrivilegedCaller(id) {
 		return true
 	}
-	// TODO: decide on unowned behavior
 	if len(p.Owners) == 0 {
-		return false
+		// A profile in a per-username directory belonged to a use, unowned fails
+		// closed. The account named by the directory reclaims it on their next
+		// lookup or until claimed by a privileged caller.
+		return p.LegacyUserDir == ""
 	}
 	return p.Owners[0].Matches(id)
 }