shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-01-22 22:03:43 +03:00
Code
systemd-stable/tmpfiles.d/systemd.conf.in

73 lines
3.1 KiB
Plaintext
Raw Normal View History

tmpfiles: install default tmpfiles configuration
2010-09-28 22:32:53 +02:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 00:20:58 +02:00
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
tmpfiles: install default tmpfiles configuration
2010-09-28 22:32:53 +02:00
# (at your option) any later version.
tmpfiles: include reference to man page in tmpfiles files
2010-11-10 23:58:01 +01:00
# See tmpfiles.d(5) for details
tmpfiles: don't do automatic cleanup in $XDG_RUNTIME_DIR Now that logind will clean up all IPC resources of a user we should really consider $XDG_RUNTIME_DIR as just another kind of IPC with the same life-cycle logic as the other IPC resources. This should be safe now to do since every user gets his own $XDG_RUNTIME_DIR tmpfs instance with a fixed size limit, so that flooding of it will more effectively be averted.
2014-06-30 19:06:18 +02:00
d /run/user 0755 root root -
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 13:35:51 +02:00
{% if ENABLE_UTMP %}
tmpfiles: introduce the concept of unsafe operations Various operations done by systemd-tmpfiles may only be safely done at boot (e.g. removal of X lockfiles in /tmp, creation of /run/nologin). Other operations may be done at any point in time (e.g. setting the ownership on /{run,var}/log/journal). This distinction is largely orthogonal to the type of operation. A new switch --unsafe is added, and operations which should only be executed during bootup are marked with an exclamation mark in the configuration files. systemd-tmpfiles.service is modified to use this switch, and guards are added so it is hard to re-start it by mistake. If we install a new version of systemd, we actually want to enforce some changes to tmpfiles configuration immediately. This should now be possible to do safely, so distribution packages can be modified to execute the "safe" subset at package installation time. /run/nologin creation is split out into a separate service, to make it easy to override. https://bugzilla.redhat.com/show_bug.cgi?id=1043212 https://bugzilla.redhat.com/show_bug.cgi?id=1045849
2013-12-20 20:25:39 -05:00
F! /run/utmp 0664 root utmp -
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 13:35:51 +02:00
{% endif %}
tmpfiles: enforce new /var/lock semantics http://lists.freedesktop.org/archives/systemd-devel/2011-March/001823.html
2011-04-01 00:43:28 +02:00
path: optionally, create watched directories in .path units
2011-04-10 01:30:14 +02:00
d /run/systemd/ask-password 0755 root root -
sd-login: beef up login api, to add monitoring and enumerating
2011-07-22 21:01:15 +02:00
d /run/systemd/seats 0755 root root -
d /run/systemd/sessions 0755 root root -
d /run/systemd/users 0755 root root -
machined: split out machine registration stuff from logind Embedded folks don't need the machine registration stuff, hence it's nice to make this optional. Also, I'd expect that machinectl will grow additional commands quickly, for example to join existing containers and suchlike, hence it's better keeping that separate from loginctl.
2013-07-02 03:47:23 +02:00
d /run/systemd/machines 0755 root root -
shutdownd: rework interface, allow subscribing to scheduled shutdowns This extends the shutdownd interface to expose schedule shutdown information in /run/systemd/shutdown/schedule. This also cleans up the shutdownd protocol and documents it in a header file sd-shutdown.h. This is supposed to be used by client code that wants to control and monitor scheduled shutdown.
2012-04-11 02:04:46 +02:00
d /run/systemd/shutdown 0755 root root -
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 13:35:51 +02:00
{% if ENABLE_NETWORKD %}
sysusers,tmpfiles: re-create systemd-network, systemd-resolve and systemd-timesync This partially reverts d4e9e574ea0b5d23598a317e68399584d229568b, 0187368cadea183e18c6d575a9d6b7f491a402af, and 4240cb02fda90ba11dfc0114201e42691132c6a9. The services systemd-networkd, systemd-resolved, and systemd-timesyncd enable DynamicUsers= and have bus interfaces. Unfortunately, these has many problems now. Let us create the relevant users, at least, tentatively. Fixes #9503.
2018-07-15 22:31:37 +09:00
d /run/systemd/netif 0755 systemd-network systemd-network -
d /run/systemd/netif/links 0755 systemd-network systemd-network -
d /run/systemd/netif/leases 0755 systemd-network systemd-network -
resolved, networkd: don't resolve the user if not root If a daemon is not started as root, most likely it also can't create its directory and let's not try to resolve the user in that case either. Create /run/systemd/netif/lldp with tmpfiles.d like other netif directories. This is also very helpful for preparing a RootImage for the daemons as NSS crud is not needed.
2019-12-06 16:36:58 +02:00
d /run/systemd/netif/lldp 0755 systemd-network systemd-network -
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 13:35:51 +02:00
{% endif %}
tmpfiles: write /run/nologin during early boot to disallow too early user logins systemd-user-sessoins.service will later on remove the flag file, thus permitting user logins when the time has come.
2012-06-25 17:35:13 +02:00
tmpfiles: explicitly set mode for /run/log
2014-06-30 19:53:10 +02:00
d /run/log 0755 root root -
tmpfiles: get rid of "m" lines, make them redundant by "z" "m" so far has been a non-globbing version of "z". Since this makes it quite redundant, let's get rid of it. Remove "m" from the man pages, beef up "z" docs instead, and make "m" nothing more than a compatibility alias for "z".
2014-06-10 23:42:16 +02:00
z /run/log/journal 2755 root systemd-journal - -
tmpfiles: don't allow read access to journal files to users not in systemd-journal Also, don't apply access mode recursively to /var/log/journal/*/, since that might be quite large, and should be correct anyway.
2014-06-11 10:23:16 +02:00
Z /run/log/journal/%m ~2750 root systemd-journal - -
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 13:35:51 +02:00
{% if HAVE_ACL %}
{% if ENABLE_ADM_GROUP and ENABLE_WHEEL_GROUP %}
tmpfiles: apply ACLs to top-level journal directory in /run, too We already apply them to the directory in /var. Let's do the same in /run too. That's because due to the log namespace logic we nowadays can gain additional subdirs there during regular operation.
2019-11-27 19:15:11 +01:00
a+ /run/log/journal - - - - d:group::r-x,d:group:adm:r-x,d:group:wheel:r-x,group::r-x,group:adm:r-x,group:wheel:r-x
tmpfiles: merge lines for the same inodes
2019-11-27 19:13:34 +01:00
a+ /run/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x,group:adm:r-x,group:wheel:r-x
tmpfiles: don't set the x bit for volatile system journal when ACL support is enabled (#3079) When ACL support is enabled, systemd-tmpfiles-setup service sets the following ACL entries to the volatile system journal: $ getfacl /run/log/journal/*/system.journal getfacl: Removing leading '/' from absolute path names # file: run/log/journal/xxx/system.journal # owner: root # group: systemd-journal user::rwx group::r-- group:wheel:r-x group:adm:r-x mask::r-x other::--- This patch makes sure that the exec bit is not set anymore for the volatile system journals.
2016-05-04 01:29:11 +02:00
a+ /run/log/journal/%m/*.journal* - - - - group:adm:r--,group:wheel:r--
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 13:35:51 +02:00
{% elif ENABLE_ADM_GROUP %}
tmpfiles: apply ACLs to top-level journal directory in /run, too We already apply them to the directory in /var. Let's do the same in /run too. That's because due to the log namespace logic we nowadays can gain additional subdirs there during regular operation.
2019-11-27 19:15:11 +01:00
a+ /run/log/journal - - - - d:group::r-x,d:group:adm:r-x,group::r-x,group:adm:r-x
tmpfiles: merge lines for the same inodes
2019-11-27 19:13:34 +01:00
a+ /run/log/journal/%m - - - - d:group:adm:r-x,group:adm:r-x
tmpfiles: don't set the x bit for volatile system journal when ACL support is enabled (#3079) When ACL support is enabled, systemd-tmpfiles-setup service sets the following ACL entries to the volatile system journal: $ getfacl /run/log/journal/*/system.journal getfacl: Removing leading '/' from absolute path names # file: run/log/journal/xxx/system.journal # owner: root # group: systemd-journal user::rwx group::r-- group:wheel:r-x group:adm:r-x mask::r-x other::--- This patch makes sure that the exec bit is not set anymore for the volatile system journals.
2016-05-04 01:29:11 +02:00
a+ /run/log/journal/%m/*.journal* - - - - group:adm:r--
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 13:35:51 +02:00
{% elif ENABLE_WHEEL_GROUP %}
tmpfiles: apply ACLs to top-level journal directory in /run, too We already apply them to the directory in /var. Let's do the same in /run too. That's because due to the log namespace logic we nowadays can gain additional subdirs there during regular operation.
2019-11-27 19:15:11 +01:00
a+ /run/log/journal - - - - d:group::r-x,d:group:wheel:r-x,group::r-x,group:wheel:r-x
tmpfiles: merge lines for the same inodes
2019-11-27 19:13:34 +01:00
a+ /run/log/journal/%m - - - - d:group:wheel:r-x,group:wheel:r-x
tmpfiles: don't set the x bit for volatile system journal when ACL support is enabled (#3079) When ACL support is enabled, systemd-tmpfiles-setup service sets the following ACL entries to the volatile system journal: $ getfacl /run/log/journal/*/system.journal getfacl: Removing leading '/' from absolute path names # file: run/log/journal/xxx/system.journal # owner: root # group: systemd-journal user::rwx group::r-- group:wheel:r-x group:adm:r-x mask::r-x other::--- This patch makes sure that the exec bit is not set anymore for the volatile system journals.
2016-05-04 01:29:11 +02:00
a+ /run/log/journal/%m/*.journal* - - - - group:wheel:r--
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 13:35:51 +02:00
{% endif %}
{% endif %}
tmpfiles: don't allow read access to journal files to users not in systemd-journal Also, don't apply access mode recursively to /var/log/journal/*/, since that might be quite large, and should be correct anyway.
2014-06-11 10:23:16 +02:00
z /var/log/journal 2755 root systemd-journal - -
z /var/log/journal/%m 2755 root systemd-journal - -
tmpfiles: set acls on system.journal explicitly https://github.com/systemd/systemd/issues/1397
2015-11-29 18:48:40 -05:00
z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 13:35:51 +02:00
{% if HAVE_ACL %}
{% if ENABLE_ADM_GROUP and ENABLE_WHEEL_GROUP %}
tmpfiles: merge lines for the same inodes
2019-11-27 19:13:34 +01:00
a+ /var/log/journal - - - - d:group::r-x,d:group:adm:r-x,d:group:wheel:r-x,group::r-x,group:adm:r-x,group:wheel:r-x
a+ /var/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x,group:adm:r-x,group:wheel:r-x
tmpfiles: set acls on system.journal explicitly https://github.com/systemd/systemd/issues/1397
2015-11-29 18:48:40 -05:00
a+ /var/log/journal/%m/system.journal - - - - group:adm:r--,group:wheel:r--
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 13:35:51 +02:00
{% elif ENABLE_ADM_GROUP %}
tmpfiles: merge lines for the same inodes
2019-11-27 19:13:34 +01:00
a+ /var/log/journal - - - - d:group::r-x,d:group:adm:r-x,group::r-x,group:adm:r-x
a+ /var/log/journal/%m - - - - d:group:adm:r-x,group:adm:r-x
build-sys: allow references to wheel group to be omitted https://github.com/systemd/systemd/issues/2492
2016-02-15 11:08:26 -05:00
a+ /var/log/journal/%m/system.journal - - - - group:adm:r--
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 13:35:51 +02:00
{% elif ENABLE_WHEEL_GROUP %}
tmpfiles: merge lines for the same inodes
2019-11-27 19:13:34 +01:00
a+ /var/log/journal - - - - d:group::r-x,d:group:wheel:r-x,group::r-x,group:wheel:r-x
a+ /var/log/journal/%m - - - - d:group:wheel:r-x,group:wheel:r-x
build-sys: allow references to adm group to be omitted (#3150)
2016-05-01 06:02:17 +02:00
a+ /var/log/journal/%m/system.journal - - - - group:wheel:r--
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 13:35:51 +02:00
{% endif %}
{% endif %}
tmpfiles: automatically clean up /var/lib/systemd/coredump after 3d
2014-06-18 22:06:25 +02:00
d /var/lib/systemd 0755 root root -
d /var/lib/systemd/coredump 0755 root root 3d
tmpfiles: create /var/{lib,log,cache}/private during early boot This directory is used by the DynamicUer= stuff when used in combination with StateDirectory=/LogDirectory=/CacheDirectory=. Let's make sure the dir exists early on with the right perms. This is not strictly necessary as we'll also create the dir on demand if it is missing, but in the interest of grabbing the name early on, and making things more explicit let's also list this in a tmpfiles.d/ snippet.
2018-05-17 19:52:37 +02:00
d /var/lib/private 0700 root root -
d /var/log/private 0700 root root -
d /var/cache/private 0700 root root -
Copy Permalink