mirror of
https://github.com/systemd/systemd-stable.git
synced 2024-12-22 13:33:56 +03:00
Revert "network: set DynamicUser= to systemd-networkd.service"
This reverts commitd4e9e574ea
. (systemd.conf.m4 part was already reverted in 5b5d82615011b9827466b7cd5756da35627a1608.) Together those reverts should "fix" #10025 and #10011. ("fix" is in quotes because this doesn't really fix the underlying issue, which is combining DynamicUser= with strict container sandbox, but it avoids the problem by not using that feature in our default installation.) Dynamic users don't work well if the service requires matching configuration in other places, for example dbus policy. This is true for those three services. In effect, distros create the user statically [1, 2]. Dynamic users make more sense for "add-on" services where not creating the user, or more precisely, creating the user lazily, can save resources. For "basic" services, if we are going to create the user on package installation anyway, setting DynamicUser= just creates unneeded confusion. The only case where it is actually used is when somebody forgets to do system configuration. But it's better to have the service fail cleanly in this case too. If we want to turn on some side-effect of DynamicUser=yes for those services, we should just do that directly through fine-grained options. By not using DynamicUser= we also avoid the need to restart dbus. [1]bd9bf30727
[2]48ac1cebde/f/systemd.spec (_473)
(Fedora does not create systemd-timesync user.)
This commit is contained in:
parent
62fb7e80fc
commit
696fc8360d
@ -151,7 +151,7 @@ int manager_connect_bus(Manager *m) {
|
||||
if (r < 0)
|
||||
return log_error_errno(r, "Failed to add network enumerator: %m");
|
||||
|
||||
r = bus_request_name_async_may_reload_dbus(m->bus, NULL, "org.freedesktop.network1", 0, NULL);
|
||||
r = sd_bus_request_name_async(m->bus, NULL, "org.freedesktop.network1", 0, NULL, NULL);
|
||||
if (r < 0)
|
||||
return log_error_errno(r, "Failed to request name: %m");
|
||||
|
||||
|
@ -13,7 +13,7 @@ Documentation=man:systemd-networkd.service(8)
|
||||
ConditionCapability=CAP_NET_ADMIN
|
||||
DefaultDependencies=no
|
||||
# systemd-udevd.service can be dropped once tuntap is moved to netlink
|
||||
After=systemd-udevd.service network-pre.target systemd-sysctl.service
|
||||
After=systemd-udevd.service network-pre.target systemd-sysusers.service systemd-sysctl.service
|
||||
Before=network.target multi-user.target shutdown.target
|
||||
Conflicts=shutdown.target
|
||||
Wants=network.target
|
||||
@ -25,9 +25,9 @@ RestartSec=0
|
||||
ExecStart=!!@rootlibexecdir@/systemd-networkd
|
||||
WatchdogSec=3min
|
||||
User=systemd-network
|
||||
DynamicUser=yes
|
||||
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
|
||||
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
|
||||
ProtectSystem=strict
|
||||
ProtectHome=yes
|
||||
ProtectControlGroups=yes
|
||||
ProtectKernelModules=yes
|
||||
|
Loading…
Reference in New Issue
Block a user