shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-01-03 01:17:45 +03:00
Code

meson: use jinja2 for unit templates

Browse Source 
We don't need two (and half) templating systems anymore, yay!

I'm keeping the changes minimal, to make the diff manageable. Some enhancements
due to a better templating system might be possible in the future.

For handling of '## ' — see the next commit.
This commit is contained in:
Zbigniew Jędrzejewski-Szmek 2021-05-16 11:55:36 +02:00 committed by Yu Watanabe
parent 6b1aac3ccf
commit 059cc610b7
65 changed files with 133 additions and 160 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
meson.build
View File

@ -242,6 +242,7 @@ conf.set_quoted('SYSTEMD_SHUTDOWN_BINARY_PATH', join_paths(rootlib
conf.set_quoted('SYSTEMCTL_BINARY_PATH', join_paths(rootbindir, 'systemctl')) conf.set_quoted('SYSTEMCTL_BINARY_PATH', join_paths(rootbindir, 'systemctl'))
conf.set_quoted('SYSTEMD_TTY_ASK_PASSWORD_AGENT_BINARY_PATH', join_paths(rootbindir, 'systemd-tty-ask-password-agent')) conf.set_quoted('SYSTEMD_TTY_ASK_PASSWORD_AGENT_BINARY_PATH', join_paths(rootbindir, 'systemd-tty-ask-password-agent'))
conf.set_quoted('SYSTEMD_STDIO_BRIDGE_BINARY_PATH', join_paths(bindir, 'systemd-stdio-bridge')) conf.set_quoted('SYSTEMD_STDIO_BRIDGE_BINARY_PATH', join_paths(bindir, 'systemd-stdio-bridge'))
conf.set_quoted('ROOTBINDIR', rootbindir)
conf.set_quoted('ROOTPREFIX', rootprefixdir) conf.set_quoted('ROOTPREFIX', rootprefixdir)
conf.set_quoted('ROOTPREFIX_NOSLASH', rootprefixdir_noslash) conf.set_quoted('ROOTPREFIX_NOSLASH', rootprefixdir_noslash)
conf.set_quoted('RANDOM_SEED_DIR', randomseeddir) conf.set_quoted('RANDOM_SEED_DIR', randomseeddir)
@ -842,6 +843,7 @@ substs.set('TTY_GID', tty_gid)
# Ensure provided GID argument is numeric, otherwise fall back to default assignment # Ensure provided GID argument is numeric, otherwise fall back to default assignment
users_gid = get_option('users-gid') users_gid = get_option('users-gid')
conf.set('USERS_GID', users_gid < 0 ? '-' : users_gid)
substs.set('USERS_GID', users_gid < 0 ? '-' : users_gid) substs.set('USERS_GID', users_gid < 0 ? '-' : users_gid)
conf.set10('ENABLE_ADM_GROUP', get_option('adm-group')) conf.set10('ENABLE_ADM_GROUP', get_option('adm-group'))
@ -887,6 +889,7 @@ if localegen_path != ''
writable = ' /usr/lib/locale' writable = ' /usr/lib/locale'
endif endif
substs.set('SERVICE_LOCALEGEN_WRITABLE', writable) substs.set('SERVICE_LOCALEGEN_WRITABLE', writable)
conf.set_quoted('SERVICE_LOCALEGEN_WRITABLE', writable)
conf.set10('HAVE_LOCALEGEN', have) conf.set10('HAVE_LOCALEGEN', have)
conf.set_quoted('GETTEXT_PACKAGE', meson.project_name()) conf.set_quoted('GETTEXT_PACKAGE', meson.project_name())
@ -894,7 +897,9 @@ conf.set_quoted('GETTEXT_PACKAGE', meson.project_name())
service_watchdog = get_option('service-watchdog') service_watchdog = get_option('service-watchdog')
watchdog_value = service_watchdog == '' ? '' : 'WatchdogSec=' + service_watchdog watchdog_value = service_watchdog == '' ? '' : 'WatchdogSec=' + service_watchdog
substs.set('SERVICE_WATCHDOG', watchdog_value) substs.set('SERVICE_WATCHDOG', watchdog_value)
conf.set_quoted('SERVICE_WATCHDOG', watchdog_value)
conf.set_quoted('SUSHELL', get_option('debug-shell'))
substs.set('SUSHELL', get_option('debug-shell')) substs.set('SUSHELL', get_option('debug-shell'))
substs.set('DEBUGTTY', get_option('debug-tty')) substs.set('DEBUGTTY', get_option('debug-tty'))
conf.set_quoted('DEBUGTTY', get_option('debug-tty')) conf.set_quoted('DEBUGTTY', get_option('debug-tty'))
@ -3741,7 +3746,7 @@ status = [
'debug shell: @0@ @ @1@'.format(get_option('debug-shell'), 'debug shell: @0@ @ @1@'.format(get_option('debug-shell'),
get_option('debug-tty')), get_option('debug-tty')),
'TTY GID: @0@'.format(tty_gid), 'TTY GID: @0@'.format(tty_gid),
'users GID: @0@'.format(substs.get('USERS_GID')), 'users GID: @0@'.format(conf.get('USERS_GID')),
'system UIDs: <=@0@ (alloc >=@1@)'.format(conf.get('SYSTEM_UID_MAX'), 'system UIDs: <=@0@ (alloc >=@1@)'.format(conf.get('SYSTEM_UID_MAX'),
conf.get('SYSTEM_ALLOC_UID_MIN')), conf.get('SYSTEM_ALLOC_UID_MIN')),
'system GIDs: <=@0@ (alloc >=@1@)'.format(conf.get('SYSTEM_GID_MAX'), 'system GIDs: <=@0@ (alloc >=@1@)'.format(conf.get('SYSTEM_GID_MAX'),

8
units/console-getty.service.m4 → units/console-getty.service.in
View File

@ -11,9 +11,9 @@
Description=Console Getty Description=Console Getty
Documentation=man:agetty(8) man:systemd-getty-generator(8) Documentation=man:agetty(8) man:systemd-getty-generator(8)
After=systemd-user-sessions.service plymouth-quit-wait.service After=systemd-user-sessions.service plymouth-quit-wait.service
m4_ifdef(`HAVE_SYSV_COMPAT', {% if HAVE_SYSV_COMPAT %}
After=rc-local.service getty-pre.target After=rc-local.service getty-pre.target
)m4_dnl {% endif %}
Before=getty.target Before=getty.target
# OCI containers may be run without a console # OCI containers may be run without a console
@ -30,9 +30,9 @@ UtmpIdentifier=cons
TTYPath=/dev/console TTYPath=/dev/console
TTYReset=yes TTYReset=yes
TTYVHangup=yes TTYVHangup=yes
m4_ifdef(`ENABLE_LOGIND',, {% if not ENABLE_LOGIND %}
KillMode=process KillMode=process
)m4_dnl {% endif %}
IgnoreSIGPIPE=no IgnoreSIGPIPE=no
SendSIGHUP=yes SendSIGHUP=yes

8
units/container-getty@.service.m4 → units/container-getty@.service.in
View File

@ -12,9 +12,9 @@ Description=Container Getty on /dev/pts/%I
Documentation=man:agetty(8) man:systemd-getty-generator(8) Documentation=man:agetty(8) man:systemd-getty-generator(8)
Documentation=man:machinectl(1) Documentation=man:machinectl(1)
After=systemd-user-sessions.service plymouth-quit-wait.service After=systemd-user-sessions.service plymouth-quit-wait.service
m4_ifdef(`HAVE_SYSV_COMPAT', {% if HAVE_SYSV_COMPAT %}
After=rc-local.service getty-pre.target After=rc-local.service getty-pre.target
)m4_dnl {% endif %}
Before=getty.target Before=getty.target
IgnoreOnIsolate=yes IgnoreOnIsolate=yes
ConditionPathExists=/dev/pts/%I ConditionPathExists=/dev/pts/%I
@ -36,8 +36,8 @@ UtmpIdentifier=pts/%I
TTYPath=/dev/pts/%I TTYPath=/dev/pts/%I
TTYReset=yes TTYReset=yes
TTYVHangup=yes TTYVHangup=yes
m4_ifdef(`ENABLE_LOGIND',, {% if not ENABLE_LOGIND %}
KillMode=process KillMode=process
)m4_dnl {% endif %}
IgnoreSIGPIPE=no IgnoreSIGPIPE=no
SendSIGHUP=yes SendSIGHUP=yes

8
units/debug-shell.service.in
View File

@ -8,19 +8,19 @@
# (at your option) any later version. # (at your option) any later version.
[Unit] [Unit]
Description=Early root shell on @DEBUGTTY@ FOR DEBUGGING ONLY Description=Early root shell on {{DEBUGTTY}} FOR DEBUGGING ONLY
Documentation=man:systemd-debug-generator(8) Documentation=man:systemd-debug-generator(8)
DefaultDependencies=no DefaultDependencies=no
IgnoreOnIsolate=yes IgnoreOnIsolate=yes
ConditionPathExists=@DEBUGTTY@ ConditionPathExists={{DEBUGTTY}}
[Service] [Service]
Environment=TERM=linux Environment=TERM=linux
ExecStart=@SUSHELL@ ExecStart={{SUSHELL}}
Restart=always Restart=always
RestartSec=0 RestartSec=0
StandardInput=tty StandardInput=tty
TTYPath=@DEBUGTTY@ TTYPath={{DEBUGTTY}}
TTYReset=yes TTYReset=yes
TTYVHangup=yes TTYVHangup=yes
KillMode=process KillMode=process

4
units/emergency.service.in
View File

@ -19,8 +19,8 @@ Before=rescue.service
[Service] [Service]
Environment=HOME=/root Environment=HOME=/root
WorkingDirectory=-/root WorkingDirectory=-/root
ExecStartPre=-@rootbindir@/plymouth --wait quit ExecStartPre=-{{ROOTBINDIR}}/plymouth --wait quit
ExecStart=-@rootlibexecdir@/systemd-sulogin-shell emergency ExecStart=-{{ROOTLIBEXECDIR}}/systemd-sulogin-shell emergency
Type=idle Type=idle
StandardInput=tty-force StandardInput=tty-force
StandardOutput=inherit StandardOutput=inherit

8
units/getty@.service.m4 → units/getty@.service.in
View File

@ -12,9 +12,9 @@ Description=Getty on %I
Documentation=man:agetty(8) man:systemd-getty-generator(8) Documentation=man:agetty(8) man:systemd-getty-generator(8)
Documentation=http://0pointer.de/blog/projects/serial-console.html Documentation=http://0pointer.de/blog/projects/serial-console.html
After=systemd-user-sessions.service plymouth-quit-wait.service getty-pre.target After=systemd-user-sessions.service plymouth-quit-wait.service getty-pre.target
m4_ifdef(`HAVE_SYSV_COMPAT', {% if HAVE_SYSV_COMPAT %}
After=rc-local.service After=rc-local.service
)m4_dnl {% endif %}
# If additional gettys are spawned during boot then we should make # If additional gettys are spawned during boot then we should make
# sure that this is synchronized before getty.target, even though # sure that this is synchronized before getty.target, even though
@ -47,9 +47,9 @@ TTYPath=/dev/%I
TTYReset=yes TTYReset=yes
TTYVHangup=yes TTYVHangup=yes
TTYVTDisallocate=yes TTYVTDisallocate=yes
m4_ifdef(`ENABLE_LOGIND',, {% if not ENABLE_LOGIND %}
KillMode=process KillMode=process
)m4_dnl {% endif %}
IgnoreSIGPIPE=no IgnoreSIGPIPE=no
SendSIGHUP=yes SendSIGHUP=yes

2
units/kmod-static-nodes.service.in
View File

@ -17,4 +17,4 @@ ConditionFileNotEmpty=/lib/modules/%v/modules.devname
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@KMOD@ static-nodes --format=tmpfiles --output=/run/tmpfiles.d/static-nodes.conf ExecStart={{KMOD}} static-nodes --format=tmpfiles --output=/run/tmpfiles.d/static-nodes.conf

48
units/meson.build
View File

@ -165,13 +165,18 @@ units = [
] ]
in_units = [ in_units = [
['console-getty.service', ''],
['container-getty@.service', ''],
['debug-shell.service', ''], ['debug-shell.service', ''],
['emergency.service', ''], ['emergency.service', ''],
['getty@.service', '',
'autovt@.service'],
['kmod-static-nodes.service', 'HAVE_KMOD ENABLE_TMPFILES', ['kmod-static-nodes.service', 'HAVE_KMOD ENABLE_TMPFILES',
'sysinit.target.wants/'], 'sysinit.target.wants/'],
['quotaon.service', 'ENABLE_QUOTACHECK'], ['quotaon.service', 'ENABLE_QUOTACHECK'],
['rc-local.service', 'HAVE_SYSV_COMPAT'], ['rc-local.service', 'HAVE_SYSV_COMPAT'],
['rescue.service', ''], ['rescue.service', ''],
['serial-getty@.service', ''],
['systemd-backlight@.service', 'ENABLE_BACKLIGHT'], ['systemd-backlight@.service', 'ENABLE_BACKLIGHT'],
['systemd-binfmt.service', 'ENABLE_BINFMT', ['systemd-binfmt.service', 'ENABLE_BINFMT',
'sysinit.target.wants/'], 'sysinit.target.wants/'],
@ -247,14 +252,6 @@ in_units = [
['user@.service', ''], ['user@.service', ''],
] ]
m4_units = [
['console-getty.service', ''],
['container-getty@.service', ''],
['getty@.service', '',
'autovt@.service '],
['serial-getty@.service', ''],
]
add_wants = [] add_wants = []
foreach tuple : in_units foreach tuple : in_units
@ -265,15 +262,11 @@ foreach tuple : in_units
install = ((conds.get(0, '') == '' or conf.get(conds[0]) == 1) and install = ((conds.get(0, '') == '' or conf.get(conds[0]) == 1) and
(conds.get(1, '') == '' or conf.get(conds[1]) == 1)) (conds.get(1, '') == '' or conf.get(conds[1]) == 1))
gen1 = configure_file( custom_target(
input : file + '.in',
output : file + '.tmp',
configuration : substs)
gen2 = custom_target(
file, file,
input : gen1, input : file + '.in',
output : file, output : file,
command : [sed, '/^## /d', '@INPUT@'], command : [meson_render_jinja2, config_h, '@INPUT@'],
capture : true, capture : true,
install : install, install : install,
install_dir : systemunitdir) install_dir : systemunitdir)
@ -285,31 +278,6 @@ foreach tuple : in_units
endif endif
endforeach endforeach
foreach tuple : m4_units
file = tuple[0]
input = tuple.get(3, file + '.m4')
# we do this here because install_data does not accept custom_target output
conds = tuple[1].split(' ')
install = ((conds.get(0, '') == '' or conf.get(conds[0]) == 1) and
(conds.get(1, '') == '' or conf.get(conds[1]) == 1))
custom_target(
file,
input : input,
output: file,
command : [meson_apply_m4, config_h, '@INPUT@'],
capture : true,
install : install,
install_dir : systemunitdir)
if tuple.length() > 2 and install
foreach target : tuple[2].split()
add_wants += [systemunitdir, target, file]
endforeach
endif
endforeach
foreach tuple : units foreach tuple : units
file = tuple[0] file = tuple[0]
input = tuple.get(3, file) input = tuple.get(3, file)

4
units/quotaon.service.in
View File

@ -13,9 +13,9 @@ Documentation=man:quotaon(8)
DefaultDependencies=no DefaultDependencies=no
After=systemd-quotacheck.service After=systemd-quotacheck.service
Before=remote-fs.target shutdown.target Before=remote-fs.target shutdown.target
ConditionPathExists=@QUOTAON@ ConditionPathExists={{QUOTAON}}
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@QUOTAON@ -aug ExecStart={{QUOTAON}} -aug

8
units/rc-local.service.in
View File

@ -8,16 +8,16 @@
# (at your option) any later version. # (at your option) any later version.
# This unit gets pulled automatically into multi-user.target by # This unit gets pulled automatically into multi-user.target by
# systemd-rc-local-generator if @RC_LOCAL_PATH@ is executable. # systemd-rc-local-generator if {{RC_LOCAL_PATH}} is executable.
[Unit] [Unit]
Description=@RC_LOCAL_PATH@ Compatibility Description={{RC_LOCAL_PATH}} Compatibility
Documentation=man:systemd-rc-local-generator(8) Documentation=man:systemd-rc-local-generator(8)
ConditionFileIsExecutable=@RC_LOCAL_PATH@ ConditionFileIsExecutable={{RC_LOCAL_PATH}}
After=network.target After=network.target
[Service] [Service]
Type=forking Type=forking
ExecStart=@RC_LOCAL_PATH@ start ExecStart={{RC_LOCAL_PATH}} start
TimeoutSec=0 TimeoutSec=0
RemainAfterExit=yes RemainAfterExit=yes
GuessMainPID=no GuessMainPID=no

4
units/rescue.service.in
View File

@ -18,8 +18,8 @@ Before=shutdown.target
[Service] [Service]
Environment=HOME=/root Environment=HOME=/root
WorkingDirectory=-/root WorkingDirectory=-/root
ExecStartPre=-@rootbindir@/plymouth --wait quit ExecStartPre=-{{ROOTBINDIR}}/plymouth --wait quit
ExecStart=-@rootlibexecdir@/systemd-sulogin-shell rescue ExecStart=-{{ROOTLIBEXECDIR}}/systemd-sulogin-shell rescue
Type=idle Type=idle
StandardInput=tty-force StandardInput=tty-force
StandardOutput=inherit StandardOutput=inherit

8
units/serial-getty@.service.m4 → units/serial-getty@.service.in
View File

@ -13,9 +13,9 @@ Documentation=man:agetty(8) man:systemd-getty-generator(8)
Documentation=http://0pointer.de/blog/projects/serial-console.html Documentation=http://0pointer.de/blog/projects/serial-console.html
BindsTo=dev-%i.device BindsTo=dev-%i.device
After=dev-%i.device systemd-user-sessions.service plymouth-quit-wait.service getty-pre.target After=dev-%i.device systemd-user-sessions.service plymouth-quit-wait.service getty-pre.target
m4_ifdef(`HAVE_SYSV_COMPAT', {% if HAVE_SYSV_COMPAT %}
After=rc-local.service After=rc-local.service
)m4_dnl {% endif %}
# If additional gettys are spawned during boot then we should make # If additional gettys are spawned during boot then we should make
# sure that this is synchronized before getty.target, even though # sure that this is synchronized before getty.target, even though
@ -40,9 +40,9 @@ UtmpIdentifier=%I
TTYPath=/dev/%I TTYPath=/dev/%I
TTYReset=yes TTYReset=yes
TTYVHangup=yes TTYVHangup=yes
m4_ifdef(`ENABLE_LOGIND',, {% if not ENABLE_LOGIND %}
KillMode=process KillMode=process
)m4_dnl {% endif %}
IgnoreSIGPIPE=no IgnoreSIGPIPE=no
SendSIGHUP=yes SendSIGHUP=yes

4
units/systemd-backlight@.service.in
View File

@ -17,7 +17,7 @@ Before=sysinit.target shutdown.target
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-backlight load %i ExecStart={{ROOTLIBEXECDIR}}/systemd-backlight load %i
ExecStop=@rootlibexecdir@/systemd-backlight save %i ExecStop={{ROOTLIBEXECDIR}}/systemd-backlight save %i
TimeoutSec=90s TimeoutSec=90s
StateDirectory=systemd/backlight StateDirectory=systemd/backlight

4
units/systemd-binfmt.service.in
View File

@ -27,6 +27,6 @@ ConditionDirectoryNotEmpty=|/run/binfmt.d
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-binfmt ExecStart={{ROOTLIBEXECDIR}}/systemd-binfmt
ExecStop=@rootlibexecdir@/systemd-binfmt --unregister ExecStop={{ROOTLIBEXECDIR}}/systemd-binfmt --unregister
TimeoutSec=90s TimeoutSec=90s

2
units/systemd-bless-boot.service.in
View File

@ -19,4 +19,4 @@ Before=shutdown.target
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-bless-boot good ExecStart={{ROOTLIBEXECDIR}}/systemd-bless-boot good

2
units/systemd-boot-check-no-failures.service.in
View File

@ -18,7 +18,7 @@ Before=shutdown.target
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-boot-check-no-failures ExecStart={{ROOTLIBEXECDIR}}/systemd-boot-check-no-failures
[Install] [Install]
RequiredBy=boot-complete.target RequiredBy=boot-complete.target

2
units/systemd-coredump@.service.in
View File

@ -17,7 +17,7 @@ Requires=systemd-journald.socket
Before=shutdown.target Before=shutdown.target
[Service] [Service]
ExecStart=-@rootlibexecdir@/systemd-coredump ExecStart=-{{ROOTLIBEXECDIR}}/systemd-coredump
IPAddressDeny=any IPAddressDeny=any
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes

2
units/systemd-fsck-root.service.in
View File

@ -18,5 +18,5 @@ ConditionPathIsReadWrite=!/
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-fsck ExecStart={{ROOTLIBEXECDIR}}/systemd-fsck
TimeoutSec=0 TimeoutSec=0

2
units/systemd-fsck@.service.in
View File

@ -19,5 +19,5 @@ Before=systemd-quotacheck.service shutdown.target
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-fsck %f ExecStart={{ROOTLIBEXECDIR}}/systemd-fsck %f
TimeoutSec=0 TimeoutSec=0

2
units/systemd-hibernate-resume@.service.in
View File

@ -19,4 +19,4 @@ AssertPathExists=/etc/initrd-release
[Service] [Service]
Type=oneshot Type=oneshot
ExecStart=@rootlibexecdir@/systemd-hibernate-resume %f ExecStart={{ROOTLIBEXECDIR}}/systemd-hibernate-resume %f

2
units/systemd-hibernate.service.in
View File

@ -16,4 +16,4 @@ After=sleep.target
[Service] [Service]
Type=oneshot Type=oneshot
ExecStart=@rootlibexecdir@/systemd-sleep hibernate ExecStart={{ROOTLIBEXECDIR}}/systemd-sleep hibernate

6
units/systemd-homed.service.in
View File

@ -20,10 +20,10 @@ CapabilityBoundingSet=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FS
DeviceAllow=/dev/loop-control rw DeviceAllow=/dev/loop-control rw
DeviceAllow=/dev/mapper/control rw DeviceAllow=/dev/mapper/control rw
DeviceAllow=block-* rw DeviceAllow=block-* rw
ExecStart=@rootlibexecdir@/systemd-homed ExecStart={{ROOTLIBEXECDIR}}/systemd-homed
IPAddressDeny=any IPAddressDeny=any
KillMode=mixed KillMode=mixed
LimitNOFILE=@HIGH_RLIMIT_NOFILE@ LimitNOFILE={{HIGH_RLIMIT_NOFILE}}
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
NoNewPrivileges=yes NoNewPrivileges=yes
@ -34,7 +34,7 @@ StateDirectory=systemd/home
SystemCallArchitectures=native SystemCallArchitectures=native
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service @mount SystemCallFilter=@system-service @mount
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

4
units/systemd-hostnamed.service.in
View File

@ -17,7 +17,7 @@ Documentation=man:org.freedesktop.resolve1(5)
[Service] [Service]
BusName=org.freedesktop.hostname1 BusName=org.freedesktop.hostname1
CapabilityBoundingSet=CAP_SYS_ADMIN CapabilityBoundingSet=CAP_SYS_ADMIN
ExecStart=@rootlibexecdir@/systemd-hostnamed ExecStart={{ROOTLIBEXECDIR}}/systemd-hostnamed
IPAddressDeny=any IPAddressDeny=any
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
@ -40,4 +40,4 @@ RestrictSUIDSGID=yes
SystemCallArchitectures=native SystemCallArchitectures=native
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service sethostname SystemCallFilter=@system-service sethostname
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}

2
units/systemd-hwdb-update.service.in
View File

@ -15,7 +15,7 @@ Conflicts=shutdown.target
After=systemd-remount-fs.service After=systemd-remount-fs.service
Before=sysinit.target shutdown.target systemd-update-done.service Before=sysinit.target shutdown.target systemd-update-done.service
ConditionNeedsUpdate=/etc ConditionNeedsUpdate=/etc
ConditionPathExists=|!@udevlibexecdir@/hwdb.bin ConditionPathExists=|!{{UDEVLIBEXECDIR}}/hwdb.bin
ConditionPathExists=|/etc/udev/hwdb.bin ConditionPathExists=|/etc/udev/hwdb.bin
ConditionDirectoryNotEmpty=|/etc/udev/hwdb.d/ ConditionDirectoryNotEmpty=|/etc/udev/hwdb.d/

2
units/systemd-hybrid-sleep.service.in
View File

@ -16,4 +16,4 @@ After=sleep.target
[Service] [Service]
Type=oneshot Type=oneshot
ExecStart=@rootlibexecdir@/systemd-sleep hybrid-sleep ExecStart={{ROOTLIBEXECDIR}}/systemd-sleep hybrid-sleep

4
units/systemd-importd.service.in
View File

@ -13,7 +13,7 @@ Documentation=man:systemd-importd.service(8)
Documentation=man:org.freedesktop.import1(5) Documentation=man:org.freedesktop.import1(5)
[Service] [Service]
ExecStart=@rootlibexecdir@/systemd-importd ExecStart={{ROOTLIBEXECDIR}}/systemd-importd
BusName=org.freedesktop.import1 BusName=org.freedesktop.import1
KillMode=mixed KillMode=mixed
CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_SYS_ADMIN CAP_SETPCAP CAP_DAC_OVERRIDE CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_SYS_ADMIN CAP_SETPCAP CAP_DAC_OVERRIDE
@ -27,4 +27,4 @@ SystemCallFilter=@system-service @mount
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM
SystemCallArchitectures=native SystemCallArchitectures=native
LockPersonality=yes LockPersonality=yes
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}

2
units/systemd-initctl.service.in
View File

@ -13,7 +13,7 @@ Documentation=man:systemd-initctl.service(8)
DefaultDependencies=no DefaultDependencies=no
[Service] [Service]
ExecStart=@rootlibexecdir@/systemd-initctl ExecStart={{ROOTLIBEXECDIR}}/systemd-initctl
NoNewPrivileges=yes NoNewPrivileges=yes
NotifyAccess=all NotifyAccess=all
SystemCallArchitectures=native SystemCallArchitectures=native

4
units/systemd-journal-gatewayd.service.in
View File

@ -14,7 +14,7 @@ Requires=systemd-journal-gatewayd.socket
[Service] [Service]
DynamicUser=yes DynamicUser=yes
ExecStart=@rootlibexecdir@/systemd-journal-gatewayd ExecStart={{ROOTLIBEXECDIR}}/systemd-journal-gatewayd
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
PrivateDevices=yes PrivateDevices=yes
@ -35,7 +35,7 @@ User=systemd-journal-gateway
# If there are many split up journal files we need a lot of fds to access them # If there are many split up journal files we need a lot of fds to access them
# all in parallel. # all in parallel.
LimitNOFILE=@HIGH_RLIMIT_NOFILE@ LimitNOFILE={{HIGH_RLIMIT_NOFILE}}
[Install] [Install]
Also=systemd-journal-gatewayd.socket Also=systemd-journal-gatewayd.socket

6
units/systemd-journal-remote.service.in
View File

@ -13,7 +13,7 @@ Documentation=man:systemd-journal-remote(8) man:journal-remote.conf(5)
Requires=systemd-journal-remote.socket Requires=systemd-journal-remote.socket
[Service] [Service]
ExecStart=@rootlibexecdir@/systemd-journal-remote --listen-https=-3 --output=/var/log/journal/remote/ ExecStart={{ROOTLIBEXECDIR}}/systemd-journal-remote --listen-https=-3 --output=/var/log/journal/remote/
LockPersonality=yes LockPersonality=yes
LogsDirectory=journal/remote LogsDirectory=journal/remote
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
@ -36,11 +36,11 @@ RestrictRealtime=yes
RestrictSUIDSGID=yes RestrictSUIDSGID=yes
SystemCallArchitectures=native SystemCallArchitectures=native
User=systemd-journal-remote User=systemd-journal-remote
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}
# If there are many split up journal files we need a lot of fds to access them # If there are many split up journal files we need a lot of fds to access them
# all in parallel. # all in parallel.
LimitNOFILE=@HIGH_RLIMIT_NOFILE@ LimitNOFILE={{HIGH_RLIMIT_NOFILE}}
[Install] [Install]
Also=systemd-journal-remote.socket Also=systemd-journal-remote.socket

6
units/systemd-journal-upload.service.in
View File

@ -15,7 +15,7 @@ After=network-online.target
[Service] [Service]
DynamicUser=yes DynamicUser=yes
ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state ExecStart={{ROOTLIBEXECDIR}}/systemd-journal-upload --save-state
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
PrivateDevices=yes PrivateDevices=yes
@ -33,11 +33,11 @@ StateDirectory=systemd/journal-upload
SupplementaryGroups=systemd-journal SupplementaryGroups=systemd-journal
SystemCallArchitectures=native SystemCallArchitectures=native
User=systemd-journal-upload User=systemd-journal-upload
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}
# If there are many split up journal files we need a lot of fds to access them # If there are many split up journal files we need a lot of fds to access them
# all in parallel. # all in parallel.
LimitNOFILE=@HIGH_RLIMIT_NOFILE@ LimitNOFILE={{HIGH_RLIMIT_NOFILE}}
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

6
units/systemd-journald.service.in
View File

@ -17,7 +17,7 @@ Before=sysinit.target
[Service] [Service]
DeviceAllow=char-* rw DeviceAllow=char-* rw
ExecStart=@rootlibexecdir@/systemd-journald ExecStart={{ROOTLIBEXECDIR}}/systemd-journald
FileDescriptorStoreMax=4224 FileDescriptorStoreMax=4224
IPAddressDeny=any IPAddressDeny=any
LockPersonality=yes LockPersonality=yes
@ -39,7 +39,7 @@ SystemCallArchitectures=native
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service SystemCallFilter=@system-service
Type=notify Type=notify
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}
# In case you're wondering why CAP_SYS_PTRACE is needed, access to # In case you're wondering why CAP_SYS_PTRACE is needed, access to
# /proc/<pid>/exe requires this capability. Thus if this capability is missing # /proc/<pid>/exe requires this capability. Thus if this capability is missing
@ -48,4 +48,4 @@ CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG C
# If there are many split up journal files we need a lot of fds to access them # If there are many split up journal files we need a lot of fds to access them
# all in parallel. # all in parallel.
LimitNOFILE=@HIGH_RLIMIT_NOFILE@ LimitNOFILE={{HIGH_RLIMIT_NOFILE}}

6
units/systemd-journald@.service.in
View File

@ -16,7 +16,7 @@ After=systemd-journald@%i.socket systemd-journald-varlink@%i.socket
[Service] [Service]
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
DevicePolicy=closed DevicePolicy=closed
ExecStart=@rootlibexecdir@/systemd-journald %i ExecStart={{ROOTLIBEXECDIR}}/systemd-journald %i
FileDescriptorStoreMax=4224 FileDescriptorStoreMax=4224
Group=systemd-journal Group=systemd-journal
IPAddressDeny=any IPAddressDeny=any
@ -37,8 +37,8 @@ SystemCallArchitectures=native
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service SystemCallFilter=@system-service
Type=notify Type=notify
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}
# If there are many split up journal files we need a lot of fds to access them # If there are many split up journal files we need a lot of fds to access them
# all in parallel. # all in parallel.
LimitNOFILE=@HIGH_RLIMIT_NOFILE@ LimitNOFILE={{HIGH_RLIMIT_NOFILE}}

6
units/systemd-localed.service.in
View File

@ -17,7 +17,7 @@ Documentation=man:org.freedesktop.locale1(5)
[Service] [Service]
BusName=org.freedesktop.locale1 BusName=org.freedesktop.locale1
CapabilityBoundingSet= CapabilityBoundingSet=
ExecStart=@rootlibexecdir@/systemd-localed ExecStart={{ROOTLIBEXECDIR}}/systemd-localed
IPAddressDeny=any IPAddressDeny=any
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
@ -33,7 +33,7 @@ ProtectKernelLogs=yes
ProtectKernelModules=yes ProtectKernelModules=yes
ProtectKernelTunables=yes ProtectKernelTunables=yes
ProtectSystem=strict ProtectSystem=strict
ReadWritePaths=/etc@SERVICE_LOCALEGEN_WRITABLE@ ReadWritePaths=/etc{{SERVICE_LOCALEGEN_WRITABLE}}
RestrictAddressFamilies=AF_UNIX RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=yes RestrictNamespaces=yes
RestrictRealtime=yes RestrictRealtime=yes
@ -41,4 +41,4 @@ RestrictSUIDSGID=yes
SystemCallArchitectures=native SystemCallArchitectures=native
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service SystemCallFilter=@system-service
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}

6
units/systemd-logind.service.in
View File

@ -30,7 +30,7 @@ DeviceAllow=char-drm rw
DeviceAllow=char-input rw DeviceAllow=char-input rw
DeviceAllow=char-tty rw DeviceAllow=char-tty rw
DeviceAllow=char-vcs rw DeviceAllow=char-vcs rw
ExecStart=@rootlibexecdir@/systemd-logind ExecStart={{ROOTLIBEXECDIR}}/systemd-logind
FileDescriptorStoreMax=512 FileDescriptorStoreMax=512
IPAddressDeny=any IPAddressDeny=any
LockPersonality=yes LockPersonality=yes
@ -58,8 +58,8 @@ StateDirectory=systemd/linger
SystemCallArchitectures=native SystemCallArchitectures=native
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service SystemCallFilter=@system-service
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}
# Increase the default a bit in order to allow many simultaneous logins since # Increase the default a bit in order to allow many simultaneous logins since
# we keep one fd open per session. # we keep one fd open per session.
LimitNOFILE=@HIGH_RLIMIT_NOFILE@ LimitNOFILE={{HIGH_RLIMIT_NOFILE}}

4
units/systemd-machined.service.in
View File

@ -19,7 +19,7 @@ RequiresMountsFor=/var/lib/machines
[Service] [Service]
BusName=org.freedesktop.machine1 BusName=org.freedesktop.machine1
CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD
ExecStart=@rootlibexecdir@/systemd-machined ExecStart={{ROOTLIBEXECDIR}}/systemd-machined
IPAddressDeny=any IPAddressDeny=any
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
@ -30,7 +30,7 @@ RestrictRealtime=yes
SystemCallArchitectures=native SystemCallArchitectures=native
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service @mount SystemCallFilter=@system-service @mount
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}
# Note that machined cannot be placed in a mount namespace, since it # Note that machined cannot be placed in a mount namespace, since it
# needs access to the host's mount namespace in order to implement the # needs access to the host's mount namespace in order to implement the

2
units/systemd-modules-load.service.in
View File

@ -25,5 +25,5 @@ ConditionKernelCommandLine=|rd.modules-load
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-modules-load ExecStart={{ROOTLIBEXECDIR}}/systemd-modules-load
TimeoutSec=90s TimeoutSec=90s

2
units/systemd-network-generator.service.in
View File

@ -17,7 +17,7 @@ Wants=network-pre.target
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-network-generator ExecStart={{ROOTLIBEXECDIR}}/systemd-network-generator
[Install] [Install]
WantedBy=sysinit.target WantedBy=sysinit.target

2
units/systemd-networkd-wait-online.service.in
View File

@ -18,7 +18,7 @@ Before=network-online.target shutdown.target
[Service] [Service]
Type=oneshot Type=oneshot
ExecStart=@rootlibexecdir@/systemd-networkd-wait-online ExecStart={{ROOTLIBEXECDIR}}/systemd-networkd-wait-online
RemainAfterExit=yes RemainAfterExit=yes
[Install] [Install]

4
units/systemd-networkd.service.in
View File

@ -23,7 +23,7 @@ AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET
BusName=org.freedesktop.network1 BusName=org.freedesktop.network1
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
DeviceAllow=char-* rw DeviceAllow=char-* rw
ExecStart=!!@rootlibexecdir@/systemd-networkd ExecStart=!!{{ROOTLIBEXECDIR}}/systemd-networkd
ExecReload=networkctl reload ExecReload=networkctl reload
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
@ -49,7 +49,7 @@ SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service SystemCallFilter=@system-service
Type=notify Type=notify
User=systemd-network User=systemd-network
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

2
units/systemd-nspawn@.service.in
View File

@ -26,7 +26,7 @@ SuccessExitStatus=133
Slice=machine.slice Slice=machine.slice
Delegate=yes Delegate=yes
TasksMax=16384 TasksMax=16384
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}
# Enforce a strict device policy, similar to the one nspawn configures when it # Enforce a strict device policy, similar to the one nspawn configures when it
# allocates its own scope unit. Make sure to keep these policies in sync if you # allocates its own scope unit. Make sure to keep these policies in sync if you

4
units/systemd-oomd.service.in
View File

@ -22,7 +22,7 @@ ConditionPathExists=/proc/pressure/memory
AmbientCapabilities=CAP_KILL CAP_DAC_OVERRIDE AmbientCapabilities=CAP_KILL CAP_DAC_OVERRIDE
BusName=org.freedesktop.oom1 BusName=org.freedesktop.oom1
CapabilityBoundingSet=CAP_KILL CAP_DAC_OVERRIDE CapabilityBoundingSet=CAP_KILL CAP_DAC_OVERRIDE
ExecStart=@rootlibexecdir@/systemd-oomd ExecStart={{ROOTLIBEXECDIR}}/systemd-oomd
IPAddressDeny=any IPAddressDeny=any
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
@ -51,7 +51,7 @@ SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service SystemCallFilter=@system-service
Type=notify Type=notify
User=systemd-oom User=systemd-oom
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

4
units/systemd-portabled.service.in
View File

@ -13,7 +13,7 @@ Documentation=man:systemd-portabled.service(8)
RequiresMountsFor=/var/lib/portables RequiresMountsFor=/var/lib/portables
[Service] [Service]
ExecStart=@rootlibexecdir@/systemd-portabled ExecStart={{ROOTLIBEXECDIR}}/systemd-portabled
BusName=org.freedesktop.portable1 BusName=org.freedesktop.portable1
CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
@ -26,4 +26,4 @@ SystemCallErrorNumber=EPERM
SystemCallArchitectures=native SystemCallArchitectures=native
LockPersonality=yes LockPersonality=yes
IPAddressDeny=any IPAddressDeny=any
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}

2
units/systemd-pstore.service.in
View File

@ -18,7 +18,7 @@ Before=sysinit.target shutdown.target
[Service] [Service]
Type=oneshot Type=oneshot
ExecStart=@rootlibexecdir@/systemd-pstore ExecStart={{ROOTLIBEXECDIR}}/systemd-pstore
RemainAfterExit=yes RemainAfterExit=yes
StateDirectory=systemd/pstore StateDirectory=systemd/pstore

4
units/systemd-quotacheck.service.in
View File

@ -13,10 +13,10 @@ Documentation=man:systemd-quotacheck.service(8)
DefaultDependencies=no DefaultDependencies=no
After=systemd-remount-fs.service After=systemd-remount-fs.service
Before=remote-fs.target shutdown.target Before=remote-fs.target shutdown.target
ConditionPathExists=@QUOTACHECK@ ConditionPathExists={{QUOTACHECK}}
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-quotacheck ExecStart={{ROOTLIBEXECDIR}}/systemd-quotacheck
TimeoutSec=0 TimeoutSec=0

6
units/systemd-random-seed.service.in
View File

@ -11,7 +11,7 @@
Description=Load/Save Random Seed Description=Load/Save Random Seed
Documentation=man:systemd-random-seed.service(8) man:random(4) Documentation=man:systemd-random-seed.service(8) man:random(4)
DefaultDependencies=no DefaultDependencies=no
RequiresMountsFor=@RANDOM_SEED@ RequiresMountsFor={{RANDOM_SEED}}
Conflicts=shutdown.target Conflicts=shutdown.target
After=systemd-remount-fs.service After=systemd-remount-fs.service
Before=first-boot-complete.target shutdown.target Before=first-boot-complete.target shutdown.target
@ -21,8 +21,8 @@ ConditionVirtualization=!container
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-random-seed load ExecStart={{ROOTLIBEXECDIR}}/systemd-random-seed load
ExecStop=@rootlibexecdir@/systemd-random-seed save ExecStop={{ROOTLIBEXECDIR}}/systemd-random-seed save
# This service waits until the kernel's entropy pool is initialized, and may be # This service waits until the kernel's entropy pool is initialized, and may be
# used as ordering barrier for service that require an initialized entropy # used as ordering barrier for service that require an initialized entropy

2
units/systemd-remount-fs.service.in
View File

@ -20,4 +20,4 @@ Wants=local-fs-pre.target
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-remount-fs ExecStart={{ROOTLIBEXECDIR}}/systemd-remount-fs

2
units/systemd-repart.service.in
View File

@ -28,7 +28,7 @@ ConditionDirectoryNotEmpty=|/sysusr/usr/local/lib/repart.d
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootbindir@/systemd-repart --dry-run=no ExecStart={{ROOTBINDIR}}/systemd-repart --dry-run=no
# The tool returns 77 if there's no existing GPT partition table # The tool returns 77 if there's no existing GPT partition table
SuccessExitStatus=77 SuccessExitStatus=77

4
units/systemd-resolved.service.in
View File

@ -24,7 +24,7 @@ Wants=nss-lookup.target
AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
BusName=org.freedesktop.resolve1 BusName=org.freedesktop.resolve1
CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
ExecStart=!!@rootlibexecdir@/systemd-resolved ExecStart=!!{{ROOTLIBEXECDIR}}/systemd-resolved
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
NoNewPrivileges=yes NoNewPrivileges=yes
@ -51,7 +51,7 @@ SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service SystemCallFilter=@system-service
Type=notify Type=notify
User=systemd-resolve User=systemd-resolve
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target

2
units/systemd-rfkill.service.in
View File

@ -17,7 +17,7 @@ After=sys-devices-virtual-misc-rfkill.device
Before=shutdown.target Before=shutdown.target
[Service] [Service]
ExecStart=@rootlibexecdir@/systemd-rfkill ExecStart={{ROOTLIBEXECDIR}}/systemd-rfkill
NoNewPrivileges=yes NoNewPrivileges=yes
StateDirectory=systemd/rfkill StateDirectory=systemd/rfkill
TimeoutSec=30s TimeoutSec=30s

2
units/systemd-suspend-then-hibernate.service.in
View File

@ -16,4 +16,4 @@ After=sleep.target
[Service] [Service]
Type=oneshot Type=oneshot
ExecStart=@rootlibexecdir@/systemd-sleep suspend-then-hibernate ExecStart={{ROOTLIBEXECDIR}}/systemd-sleep suspend-then-hibernate

2
units/systemd-suspend.service.in
View File

@ -16,4 +16,4 @@ After=sleep.target
[Service] [Service]
Type=oneshot Type=oneshot
ExecStart=@rootlibexecdir@/systemd-sleep suspend ExecStart={{ROOTLIBEXECDIR}}/systemd-sleep suspend

2
units/systemd-sysctl.service.in
View File

@ -19,5 +19,5 @@ ConditionPathIsReadWrite=/proc/sys/net/
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-sysctl ExecStart={{ROOTLIBEXECDIR}}/systemd-sysctl
TimeoutSec=90s TimeoutSec=90s

2
units/systemd-time-wait-sync.service.in
View File

@ -28,7 +28,7 @@ Conflicts=shutdown.target
[Service] [Service]
Type=oneshot Type=oneshot
ExecStart=@rootlibexecdir@/systemd-time-wait-sync ExecStart={{ROOTLIBEXECDIR}}/systemd-time-wait-sync
TimeoutStartSec=infinity TimeoutStartSec=infinity
RemainAfterExit=yes RemainAfterExit=yes

4
units/systemd-timedated.service.in
View File

@ -17,7 +17,7 @@ Documentation=man:org.freedesktop.timedate1(5)
BusName=org.freedesktop.timedate1 BusName=org.freedesktop.timedate1
CapabilityBoundingSet=CAP_SYS_TIME CapabilityBoundingSet=CAP_SYS_TIME
DeviceAllow=char-rtc r DeviceAllow=char-rtc r
ExecStart=@rootlibexecdir@/systemd-timedated ExecStart={{ROOTLIBEXECDIR}}/systemd-timedated
IPAddressDeny=any IPAddressDeny=any
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
@ -39,4 +39,4 @@ RestrictSUIDSGID=yes
SystemCallArchitectures=native SystemCallArchitectures=native
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service @clock SystemCallFilter=@system-service @clock
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}

4
units/systemd-timesyncd.service.in
View File

@ -26,7 +26,7 @@ CapabilityBoundingSet=CAP_SYS_TIME
# correct time to work, but we likely won't acquire that without NTP. Let's # correct time to work, but we likely won't acquire that without NTP. Let's
# break this chicken-and-egg cycle here. # break this chicken-and-egg cycle here.
Environment=SYSTEMD_NSS_RESOLVE_VALIDATE=0 Environment=SYSTEMD_NSS_RESOLVE_VALIDATE=0
ExecStart=!!@rootlibexecdir@/systemd-timesyncd ExecStart=!!{{ROOTLIBEXECDIR}}/systemd-timesyncd
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
NoNewPrivileges=yes NoNewPrivileges=yes
@ -53,7 +53,7 @@ SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service @clock SystemCallFilter=@system-service @clock
Type=notify Type=notify
User=systemd-timesync User=systemd-timesync
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}
[Install] [Install]
WantedBy=sysinit.target WantedBy=sysinit.target

4
units/systemd-udevd.service.in
View File

@ -24,7 +24,7 @@ OOMScoreAdjust=-1000
Sockets=systemd-udevd-control.socket systemd-udevd-kernel.socket Sockets=systemd-udevd-control.socket systemd-udevd-kernel.socket
Restart=always Restart=always
RestartSec=0 RestartSec=0
ExecStart=@rootlibexecdir@/systemd-udevd ExecStart={{ROOTLIBEXECDIR}}/systemd-udevd
ExecReload=udevadm control --reload --timeout 0 ExecReload=udevadm control --reload --timeout 0
KillMode=mixed KillMode=mixed
TasksMax=infinity TasksMax=infinity
@ -40,4 +40,4 @@ SystemCallErrorNumber=EPERM
SystemCallArchitectures=native SystemCallArchitectures=native
LockPersonality=yes LockPersonality=yes
IPAddressDeny=any IPAddressDeny=any
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}

2
units/systemd-update-done.service.in
View File

@ -20,4 +20,4 @@ ConditionNeedsUpdate=|/var
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-update-done ExecStart={{ROOTLIBEXECDIR}}/systemd-update-done

2
units/systemd-update-utmp-runlevel.service.in
View File

@ -20,4 +20,4 @@ Before=shutdown.target
[Service] [Service]
Type=oneshot Type=oneshot
ExecStart=@rootlibexecdir@/systemd-update-utmp runlevel ExecStart={{ROOTLIBEXECDIR}}/systemd-update-utmp runlevel

4
units/systemd-update-utmp.service.in
View File

@ -19,5 +19,5 @@ Before=sysinit.target shutdown.target
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-update-utmp reboot ExecStart={{ROOTLIBEXECDIR}}/systemd-update-utmp reboot
ExecStop=@rootlibexecdir@/systemd-update-utmp shutdown ExecStop={{ROOTLIBEXECDIR}}/systemd-update-utmp shutdown

4
units/systemd-user-sessions.service.in
View File

@ -15,5 +15,5 @@ After=remote-fs.target nss-user-lookup.target network.target home.mount
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-user-sessions start ExecStart={{ROOTLIBEXECDIR}}/systemd-user-sessions start
ExecStop=@rootlibexecdir@/systemd-user-sessions stop ExecStop={{ROOTLIBEXECDIR}}/systemd-user-sessions stop

6
units/systemd-userdbd.service.in
View File

@ -17,9 +17,9 @@ DefaultDependencies=no
[Service] [Service]
CapabilityBoundingSet=CAP_DAC_READ_SEARCH CapabilityBoundingSet=CAP_DAC_READ_SEARCH
ExecStart=@rootlibexecdir@/systemd-userdbd ExecStart={{ROOTLIBEXECDIR}}/systemd-userdbd
IPAddressDeny=any IPAddressDeny=any
LimitNOFILE=@HIGH_RLIMIT_NOFILE@ LimitNOFILE={{HIGH_RLIMIT_NOFILE}}
LockPersonality=yes LockPersonality=yes
MemoryDenyWriteExecute=yes MemoryDenyWriteExecute=yes
NoNewPrivileges=yes NoNewPrivileges=yes
@ -39,7 +39,7 @@ SystemCallArchitectures=native
SystemCallErrorNumber=EPERM SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service SystemCallFilter=@system-service
Type=notify Type=notify
@SERVICE_WATCHDOG@ {{SERVICE_WATCHDOG}}
[Install] [Install]
Also=systemd-userdbd.socket Also=systemd-userdbd.socket

2
units/systemd-vconsole-setup.service.in
View File

@ -17,4 +17,4 @@ ConditionPathExists=/dev/tty0
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-vconsole-setup ExecStart={{ROOTLIBEXECDIR}}/systemd-vconsole-setup

2
units/systemd-volatile-root.service.in
View File

@ -19,4 +19,4 @@ AssertPathExists=/etc/initrd-release
[Service] [Service]
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-volatile-root yes /sysroot ExecStart={{ROOTLIBEXECDIR}}/systemd-volatile-root yes /sysroot

4
units/user-runtime-dir@.service.in
View File

@ -15,8 +15,8 @@ StopWhenUnneeded=yes
IgnoreOnIsolate=yes IgnoreOnIsolate=yes
[Service] [Service]
ExecStart=@rootlibexecdir@/systemd-user-runtime-dir start %i ExecStart={{ROOTLIBEXECDIR}}/systemd-user-runtime-dir start %i
ExecStop=@rootlibexecdir@/systemd-user-runtime-dir stop %i ExecStop={{ROOTLIBEXECDIR}}/systemd-user-runtime-dir stop %i
Type=oneshot Type=oneshot
RemainAfterExit=yes RemainAfterExit=yes
Slice=user-%i.slice Slice=user-%i.slice

2
units/user@.service.in
View File

@ -18,7 +18,7 @@ IgnoreOnIsolate=yes
User=%i User=%i
PAMName=systemd-user PAMName=systemd-user
Type=notify Type=notify
ExecStart=@rootlibexecdir@/systemd --user ExecStart={{ROOTLIBEXECDIR}}/systemd --user
Slice=user-%i.slice Slice=user-%i.slice
KillMode=mixed KillMode=mixed
Delegate=pids memory Delegate=pids memory