D01-GN: Yes
Rationale
The documented single-user GNUnet setup starts the services with gnunet-arm as the user. In the selected known-neighbor UDP/CORE/CADET profile, NAT/ICMP/VPN/DNS helpers are excluded and a nonprivileged UDP port can be used. System-wide installation is separate from routine user operation.
Assessment method
Specification/source/dependency analysis; no new runtime execution
Source context
Primary documentation and explicitly selected composition; documentary review 2026-10-15
Outstanding qualification
Keep privileged optional helpers disabled and user-owned stores; no live permissions trace was performed.