shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-01-20 14:03:39 +03:00
Code
systemd-stable/tmpfiles.d/systemd.conf.m4

78 lines
3.0 KiB
Plaintext
Raw Normal View History

tmpfiles: install default tmpfiles configuration
2010-09-28 22:32:53 +02:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 00:20:58 +02:00
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
tmpfiles: install default tmpfiles configuration
2010-09-28 22:32:53 +02:00
# (at your option) any later version.
tmpfiles: include reference to man page in tmpfiles files
2010-11-10 23:58:01 +01:00
# See tmpfiles.d(5) for details
tmpfiles: don't do automatic cleanup in $XDG_RUNTIME_DIR Now that logind will clean up all IPC resources of a user we should really consider $XDG_RUNTIME_DIR as just another kind of IPC with the same life-cycle logic as the other IPC resources. This should be safe now to do since every user gets his own $XDG_RUNTIME_DIR tmpfs instance with a fixed size limit, so that flooding of it will more effectively be averted.
2014-06-30 19:06:18 +02:00
d /run/user 0755 root root -
tmpfiles: introduce the concept of unsafe operations Various operations done by systemd-tmpfiles may only be safely done at boot (e.g. removal of X lockfiles in /tmp, creation of /run/nologin). Other operations may be done at any point in time (e.g. setting the ownership on /{run,var}/log/journal). This distinction is largely orthogonal to the type of operation. A new switch --unsafe is added, and operations which should only be executed during bootup are marked with an exclamation mark in the configuration files. systemd-tmpfiles.service is modified to use this switch, and guards are added so it is hard to re-start it by mistake. If we install a new version of systemd, we actually want to enforce some changes to tmpfiles configuration immediately. This should now be possible to do safely, so distribution packages can be modified to execute the "safe" subset at package installation time. /run/nologin creation is split out into a separate service, to make it easy to override. https://bugzilla.redhat.com/show_bug.cgi?id=1043212 https://bugzilla.redhat.com/show_bug.cgi?id=1045849
2013-12-20 20:25:39 -05:00
F! /run/utmp 0664 root utmp -
tmpfiles: enforce new /var/lock semantics http://lists.freedesktop.org/archives/systemd-devel/2011-March/001823.html
2011-04-01 00:43:28 +02:00
path: optionally, create watched directories in .path units
2011-04-10 01:30:14 +02:00
d /run/systemd/ask-password 0755 root root -
sd-login: beef up login api, to add monitoring and enumerating
2011-07-22 21:01:15 +02:00
d /run/systemd/seats 0755 root root -
d /run/systemd/sessions 0755 root root -
d /run/systemd/users 0755 root root -
machined: split out machine registration stuff from logind Embedded folks don't need the machine registration stuff, hence it's nice to make this optional. Also, I'd expect that machinectl will grow additional commands quickly, for example to join existing containers and suchlike, hence it's better keeping that separate from loginctl.
2013-07-02 03:47:23 +02:00
d /run/systemd/machines 0755 root root -
shutdownd: rework interface, allow subscribing to scheduled shutdowns This extends the shutdownd interface to expose schedule shutdown information in /run/systemd/shutdown/schedule. This also cleans up the shutdownd protocol and documents it in a header file sd-shutdown.h. This is supposed to be used by client code that wants to control and monitor scheduled shutdown.
2012-04-11 02:04:46 +02:00
d /run/systemd/shutdown 0755 root root -
build-sys: configure the list of system users, files and directories Choose which system users defined in sysusers.d/systemd.conf and files or directories in tmpfiles.d/systemd.conf, should be provided depending on comile-time configuration.
2014-11-28 15:59:59 +01:00
m4_ifdef(`ENABLE_NETWORKD',
sysusers,tmpfiles: re-create systemd-network, systemd-resolve and systemd-timesync This partially reverts d4e9e574ea0b5d23598a317e68399584d229568b, 0187368cadea183e18c6d575a9d6b7f491a402af, and 4240cb02fda90ba11dfc0114201e42691132c6a9. The services systemd-networkd, systemd-resolved, and systemd-timesyncd enable DynamicUsers= and have bus interfaces. Unfortunately, these has many problems now. Let us create the relevant users, at least, tentatively. Fixes #9503.
2018-07-15 22:31:37 +09:00
d /run/systemd/netif 0755 systemd-network systemd-network -
d /run/systemd/netif/links 0755 systemd-network systemd-network -
d /run/systemd/netif/leases 0755 systemd-network systemd-network -
build-sys: configure the list of system users, files and directories Choose which system users defined in sysusers.d/systemd.conf and files or directories in tmpfiles.d/systemd.conf, should be provided depending on comile-time configuration.
2014-11-28 15:59:59 +01:00
)m4_dnl
tmpfiles: write /run/nologin during early boot to disallow too early user logins systemd-user-sessoins.service will later on remove the flag file, thus permitting user logins when the time has come.
2012-06-25 17:35:13 +02:00
tmpfiles: explicitly set mode for /run/log
2014-06-30 19:53:10 +02:00
d /run/log 0755 root root -
tmpfiles: get rid of "m" lines, make them redundant by "z" "m" so far has been a non-globbing version of "z". Since this makes it quite redundant, let's get rid of it. Remove "m" from the man pages, beef up "z" docs instead, and make "m" nothing more than a compatibility alias for "z".
2014-06-10 23:42:16 +02:00
z /run/log/journal 2755 root systemd-journal - -
tmpfiles: don't allow read access to journal files to users not in systemd-journal Also, don't apply access mode recursively to /var/log/journal/*/, since that might be quite large, and should be correct anyway.
2014-06-11 10:23:16 +02:00
Z /run/log/journal/%m ~2750 root systemd-journal - -
build-sys: allow references to adm group to be omitted (#3150)
2016-05-01 06:02:17 +02:00
m4_ifdef(`HAVE_ACL',`m4_dnl
m4_ifdef(`ENABLE_ADM_GROUP',`m4_dnl
build-sys: allow references to wheel group to be omitted https://github.com/systemd/systemd/issues/2492
2016-02-15 11:08:26 -05:00
m4_ifdef(`ENABLE_WHEEL_GROUP',``
tmpfiles: use ACL magic on journal directories
2015-01-18 15:05:40 -05:00
a+ /run/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x
tmpfiles: don't set the x bit for volatile system journal when ACL support is enabled (#3079) When ACL support is enabled, systemd-tmpfiles-setup service sets the following ACL entries to the volatile system journal: $ getfacl /run/log/journal/*/system.journal getfacl: Removing leading '/' from absolute path names # file: run/log/journal/xxx/system.journal # owner: root # group: systemd-journal user::rwx group::r-- group:wheel:r-x group:adm:r-x mask::r-x other::--- This patch makes sure that the exec bit is not set anymore for the volatile system journals.
2016-05-04 01:29:11 +02:00
a+ /run/log/journal/%m - - - - group:adm:r-x,group:wheel:r-x
a+ /run/log/journal/%m/*.journal* - - - - group:adm:r--,group:wheel:r--
build-sys: allow references to wheel group to be omitted https://github.com/systemd/systemd/issues/2492
2016-02-15 11:08:26 -05:00
'',``
a+ /run/log/journal/%m - - - - d:group:adm:r-x
tmpfiles: don't set the x bit for volatile system journal when ACL support is enabled (#3079) When ACL support is enabled, systemd-tmpfiles-setup service sets the following ACL entries to the volatile system journal: $ getfacl /run/log/journal/*/system.journal getfacl: Removing leading '/' from absolute path names # file: run/log/journal/xxx/system.journal # owner: root # group: systemd-journal user::rwx group::r-- group:wheel:r-x group:adm:r-x mask::r-x other::--- This patch makes sure that the exec bit is not set anymore for the volatile system journals.
2016-05-04 01:29:11 +02:00
a+ /run/log/journal/%m - - - - group:adm:r-x
a+ /run/log/journal/%m/*.journal* - - - - group:adm:r--
build-sys: allow references to adm group to be omitted (#3150)
2016-05-01 06:02:17 +02:00
'')',`m4_dnl
m4_ifdef(`ENABLE_WHEEL_GROUP',``
a+ /run/log/journal/%m - - - - d:group:wheel:r-x
tmpfiles: don't set the x bit for volatile system journal when ACL support is enabled (#3079) When ACL support is enabled, systemd-tmpfiles-setup service sets the following ACL entries to the volatile system journal: $ getfacl /run/log/journal/*/system.journal getfacl: Removing leading '/' from absolute path names # file: run/log/journal/xxx/system.journal # owner: root # group: systemd-journal user::rwx group::r-- group:wheel:r-x group:adm:r-x mask::r-x other::--- This patch makes sure that the exec bit is not set anymore for the volatile system journals.
2016-05-04 01:29:11 +02:00
a+ /run/log/journal/%m - - - - group:wheel:r-x
a+ /run/log/journal/%m/*.journal* - - - - group:wheel:r--
build-sys: allow references to adm group to be omitted (#3150)
2016-05-01 06:02:17 +02:00
'')')')m4_dnl
tmpfiles: don't allow read access to journal files to users not in systemd-journal Also, don't apply access mode recursively to /var/log/journal/*/, since that might be quite large, and should be correct anyway.
2014-06-11 10:23:16 +02:00
z /var/log/journal 2755 root systemd-journal - -
z /var/log/journal/%m 2755 root systemd-journal - -
tmpfiles: set acls on system.journal explicitly https://github.com/systemd/systemd/issues/1397
2015-11-29 18:48:40 -05:00
z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
build-sys: allow references to adm group to be omitted (#3150)
2016-05-01 06:02:17 +02:00
m4_ifdef(`HAVE_ACL',`m4_dnl
m4_ifdef(`ENABLE_ADM_GROUP',`m4_dnl
build-sys: allow references to wheel group to be omitted https://github.com/systemd/systemd/issues/2492
2016-02-15 11:08:26 -05:00
m4_ifdef(`ENABLE_WHEEL_GROUP',``
tmpfiles.d: set primary group rights to r-w (#5265) If the /var/log/journal directory is created with rigths 700, the application of an ACL rules without any primary group right sets it to 0. A chmod 755 on this file will then only set the ACL mask and let the ACL primary group right to 0. The directory is then unreadable for the primary group. This patch explicitly sets the primary group to avoid this problem. Fixes #5264.
2017-02-08 00:56:55 +01:00
a+ /var/log/journal - - - - d:group::r-x,d:group:adm:r-x,d:group:wheel:r-x
a+ /var/log/journal - - - - group::r-x,group:adm:r-x,group:wheel:r-x
tmpfiles: use ACL magic on journal directories
2015-01-18 15:05:40 -05:00
a+ /var/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x
tmpfiles: don't recursively descend into journal directories in /var Do so only in /run. We shouldn't alter ACLs for existing files in /var, but only for new files. If the admin made changes to the ACLs they shouls stay in place. We should still do recursive ACL changes for files in /run, since those are not persistent, and will hence lack ACLs on every boot. Also, /var/log/journal might be quit large, /run/log/journal is usually not, hence we should avoid the recursive descending on /var, but not on /run. Fixes #534
2015-07-09 18:43:55 -03:00
a+ /var/log/journal/%m - - - - group:adm:r-x,group:wheel:r-x
tmpfiles: set acls on system.journal explicitly https://github.com/systemd/systemd/issues/1397
2015-11-29 18:48:40 -05:00
a+ /var/log/journal/%m/system.journal - - - - group:adm:r--,group:wheel:r--
build-sys: allow references to adm group to be omitted (#3150)
2016-05-01 06:02:17 +02:00
'', ``
tmpfiles.d: set primary group rights to r-w (#5265) If the /var/log/journal directory is created with rigths 700, the application of an ACL rules without any primary group right sets it to 0. A chmod 755 on this file will then only set the ACL mask and let the ACL primary group right to 0. The directory is then unreadable for the primary group. This patch explicitly sets the primary group to avoid this problem. Fixes #5264.
2017-02-08 00:56:55 +01:00
a+ /var/log/journal - - - - d:group::r-x,d:group:adm:r-x
a+ /var/log/journal - - - - group::r-x,group:adm:r-x
build-sys: allow references to wheel group to be omitted https://github.com/systemd/systemd/issues/2492
2016-02-15 11:08:26 -05:00
a+ /var/log/journal/%m - - - - d:group:adm:r-x
a+ /var/log/journal/%m - - - - group:adm:r-x
a+ /var/log/journal/%m/system.journal - - - - group:adm:r--
build-sys: allow references to adm group to be omitted (#3150)
2016-05-01 06:02:17 +02:00
'')',`m4_dnl
m4_ifdef(`ENABLE_WHEEL_GROUP',``
tmpfiles.d: set primary group rights to r-w (#5265) If the /var/log/journal directory is created with rigths 700, the application of an ACL rules without any primary group right sets it to 0. A chmod 755 on this file will then only set the ACL mask and let the ACL primary group right to 0. The directory is then unreadable for the primary group. This patch explicitly sets the primary group to avoid this problem. Fixes #5264.
2017-02-08 00:56:55 +01:00
a+ /var/log/journal - - - - d:group::r-x,d:group:wheel:r-x
a+ /var/log/journal - - - - group::r-x,group:wheel:r-x
build-sys: allow references to adm group to be omitted (#3150)
2016-05-01 06:02:17 +02:00
a+ /var/log/journal/%m - - - - d:group:wheel:r-x
a+ /var/log/journal/%m - - - - group:wheel:r-x
a+ /var/log/journal/%m/system.journal - - - - group:wheel:r--
'')')')m4_dnl
tmpfiles: automatically clean up /var/lib/systemd/coredump after 3d
2014-06-18 22:06:25 +02:00
d /var/lib/systemd 0755 root root -
d /var/lib/systemd/coredump 0755 root root 3d
tmpfiles: create /var/{lib,log,cache}/private during early boot This directory is used by the DynamicUer= stuff when used in combination with StateDirectory=/LogDirectory=/CacheDirectory=. Let's make sure the dir exists early on with the right perms. This is not strictly necessary as we'll also create the dir on demand if it is missing, but in the interest of grabbing the name early on, and making things more explicit let's also list this in a tmpfiles.d/ snippet.
2018-05-17 19:52:37 +02:00
d /var/lib/private 0700 root root -
d /var/log/private 0700 root root -
d /var/cache/private 0700 root root -
Copy Permalink