shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-01 17:51:22 +03:00
Code
0809d7740c
systemd/units/systemd-logind.service.in

36 lines
1.3 KiB
SYSTEMD
Raw Normal View History

dbus: add dbus introspection extraction
2011-06-17 02:15:02 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 02:20:58 +04:00
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
dbus: add dbus introspection extraction
2011-06-17 02:15:02 +04:00
# (at your option) any later version.
[Unit]
Description=Login Service
units: fix section of man page link in systemd-logind.service https://bugs.freedesktop.org/show_bug.cgi?id=51963
2012-07-19 14:46:55 +04:00
Documentation=man:systemd-logind.service(8) man:logind.conf(5)
units: add references to bus API documentation to logind+machined
2013-07-19 05:49:07 +04:00
Documentation=http://www.freedesktop.org/wiki/Software/systemd/logind
units: introduce new Documentation= field and make use of it everywhere This should help making the boot process a bit easier to explore and understand for the administrator. The simple idea is that "systemctl status" now shows a link to documentation alongside the other status and decriptionary information of a service. This patch adds the necessary fields to all our shipped units if we have proper documentation for them.
2012-05-21 17:12:18 +04:00
Documentation=http://www.freedesktop.org/wiki/Software/systemd/multiseat
machined: split out machine registration stuff from logind Embedded folks don't need the machine registration stuff, hence it's nice to make this optional. Also, I'd expect that machinectl will grow additional commands quickly, for example to join existing containers and suchlike, hence it's better keeping that separate from loginctl.
2013-07-02 05:47:23 +04:00
Wants=user.slice
After=nss-user-lookup.target user.slice
dbus: add dbus introspection extraction
2011-06-17 02:15:02 +04:00
units: systemd-logind fails hard without dbus That is, without --enable-kdbus and kdbus running. With --enable-kdbus things are more complicated, because dbus might be necessary, if kdbus is missing at runtime. If it is not necessary, the socket will be started, which is not imporant, but not the service.
2014-02-15 02:01:43 +04:00
# Ask for the dbus socket. If running over kdbus, the socket will
# not be actually used.
Wants=dbus.socket
After=dbus.socket
dbus: add dbus introspection extraction
2011-06-17 02:15:02 +04:00
[Service]
ExecStart=@rootlibexecdir@/systemd-logind
units: automatically respawn the core services
2012-06-28 14:13:52 +04:00
Restart=always
units: don't enforce a holdoff time for journald, logind, udevd These services should be restarted as quickly as possible if they fail, and the extra safety net of the holdoff time is not necessary.
2012-07-18 04:31:52 +04:00
RestartSec=0
dbus: add dbus introspection extraction
2011-06-17 02:15:02 +04:00
BusName=org.freedesktop.login1
units: increase watchdog timeout to 3min for all our services Apparently, disk IO issues are more frequent than we hope, and 1min waiting for disk IO happens, so let's increase the watchdog timeout a bit, for all our services. See #1353 for an example where this triggers.
2015-09-23 18:27:39 +03:00
WatchdogSec=3min
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG
units: enable MemoryDenyWriteExecute (#3459) Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute. Closes: #3459
2016-06-08 15:23:37 +03:00
MemoryDenyWriteExecute=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
units: tighten system call filters a bit Take away kernel keyring access, CPU emulation system calls and various debug system calls from the various daemons we have.
2016-06-10 19:00:12 +03:00
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io
units: increase LimitNOFILE a bit since we need one fd per session (for logind) and one fd per service (for stdout-syslog-bridge) increase the default rlimit a bit.
2011-10-11 06:43:29 +04:00
# Increase the default a bit in order to allow many simultaneous
# logins since we keep one fd open per session.
LimitNOFILE=16384
Copy Permalink