shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-12-23 21:35:11 +03:00
Code
16d4aed919
systemd/units/systemd-homed.service.in

43 lines
1.4 KiB
SYSTEMD
Raw Normal View History

license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 07:23:58 +03:00
# SPDX-License-Identifier: LGPL-2.1-or-later
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
#
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
homed: replace "home directory" with "home area" in a few places
2020-03-11 15:07:10 +03:00
Description=Home Area Manager
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
Documentation=man:systemd-homed.service(8)
man,units: link to the new dbus-api man pages
2020-09-29 09:03:10 +03:00
Documentation=man:org.freedesktop.home1(5)
homed: stop before stopping dbus Otherwise, systemd-homed-active.service will fail to deactivate all homes because homectl can no longer talk to homed if dbus stops first. As a result, /home cannot be umounted. Doing this on systemd-homed-active.service instead works as well, but systemd-homed will exit 1 if dbus is already shut down.
2022-01-04 15:56:11 +03:00
After=home.mount dbus.service
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
[Service]
BusName=org.freedesktop.home1
units: relax sandbox so that uidmap stuff can work The uidmap suff requires additional caps and userns to work in some cases. Allow it. Follow-up for: 1147c538bbb6a2d3d5ba2e40f1437bcbeb22b33e
2021-11-15 18:21:59 +03:00
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE CAP_SETPCAP CAP_DAC_READ_SEARCH CAP_SETFCAP
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
DeviceAllow=/dev/loop-control rw
DeviceAllow=/dev/mapper/control rw
DeviceAllow=block-* rw
homed: allow systemd-homed access to FIDO2 devices Add DeviceAllow= option for FIDO2 devices in systemd-homed.service.
2021-07-12 20:57:43 +03:00
DeviceAllow=char-hidraw rw
Drop split-usr and unmerged-usr support As previously announced, execute order 66: https://lists.freedesktop.org/archives/systemd-devel/2022-September/048352.html The meson options split-usr, rootlibdir and rootprefix become no-ops that print a warning if they are set to anything other than the default values. We can remove them in a future release.
2023-06-12 04:15:19 +03:00
ExecStart={{LIBEXECDIR}}/systemd-homed
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
KillMode=mixed
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
LimitNOFILE={{HIGH_RLIMIT_NOFILE}}
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
homed: add missing capabilities for SMB/CIFS backend In 2020 mount.cifs started to require a bunch for caps to work. let's add them to the capability bounding set. Also, SMB support obviously needs network access, hence open that up. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1962920
2021-08-31 11:04:06 +03:00
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_ALG AF_INET AF_INET6
units: relax sandbox so that uidmap stuff can work The uidmap suff requires additional caps and userns to work in some cases. Allow it. Follow-up for: 1147c538bbb6a2d3d5ba2e40f1437bcbeb22b33e
2021-11-15 18:21:59 +03:00
RestrictNamespaces=mnt user
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
RestrictRealtime=yes
StateDirectory=systemd/home
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
systemd-homed.service.in: add quotactl to SystemCallFilter Standard directories make a call to the quotactl system call to enforce disk size limits. Fixes #30287
2023-12-01 19:29:32 +03:00
SystemCallFilter=@system-service @mount quotactl
units: prolong the stop timeout for homed Let's give IO/resizing/… more time then usual. Fixes: #22901
2022-09-05 16:15:36 +03:00
TimeoutStopSec=3min
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
{{SERVICE_WATCHDOG}}
units: make systemd-homed.service installable Fixes #15083. Users might want to disable homed if not used to save resources.
2020-03-13 20:38:09 +03:00
[Install]
WantedBy=multi-user.target
Alias=dbus-org.freedesktop.home1.service
homectl: add "firstboot" command This extends what systemd-firstboot does and runs on first boots only and either processes user records passed in via credentials to create, or asks the user interactively to create one (only if no regular user exists yet).
2023-11-22 12:58:14 +03:00
Also=systemd-homed-activate.service systemd-userdbd.service systemd-homed-firstboot.service
Copy Permalink