shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-05 15:21:37 +03:00
Code
1b78172b5a
systemd/units/systemd-logind.service.in

45 lines
1.4 KiB
SYSTEMD
Raw Normal View History

Add SPDX license headers to unit files
2017-11-18 19:35:03 +03:00
# SPDX-License-Identifier: LGPL-2.1+
#
dbus: add dbus introspection extraction
2011-06-17 02:15:02 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 02:20:58 +04:00
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
dbus: add dbus introspection extraction
2011-06-17 02:15:02 +04:00
# (at your option) any later version.
[Unit]
Description=Login Service
units: fix section of man page link in systemd-logind.service https://bugs.freedesktop.org/show_bug.cgi?id=51963
2012-07-19 14:46:55 +04:00
Documentation=man:systemd-logind.service(8) man:logind.conf(5)
units: use https for the freedesktop url (#6227)
2017-06-29 05:54:12 +03:00
Documentation=https://www.freedesktop.org/wiki/Software/systemd/logind
Documentation=https://www.freedesktop.org/wiki/Software/systemd/multiseat
machined: split out machine registration stuff from logind Embedded folks don't need the machine registration stuff, hence it's nice to make this optional. Also, I'd expect that machinectl will grow additional commands quickly, for example to join existing containers and suchlike, hence it's better keeping that separate from loginctl.
2013-07-02 05:47:23 +04:00
Wants=user.slice
After=nss-user-lookup.target user.slice
dbus: add dbus introspection extraction
2011-06-17 02:15:02 +04:00
Drop kdbus bits Some kdbus_flag and memfd related parts are left behind, because they are entangled with the "legacy" dbus support. test-bus-benchmark is switched to "manual". It was already broken before (in the non-kdbus mode) but apparently nobody noticed. Hopefully it can be fixed later.
2017-07-23 18:45:57 +03:00
# Ask for the dbus socket.
units: systemd-logind fails hard without dbus That is, without --enable-kdbus and kdbus running. With --enable-kdbus things are more complicated, because dbus might be necessary, if kdbus is missing at runtime. If it is not necessary, the socket will be started, which is not imporant, but not the service.
2014-02-15 02:01:43 +04:00
Wants=dbus.socket
After=dbus.socket
dbus: add dbus introspection extraction
2011-06-17 02:15:02 +04:00
[Service]
BusName=org.freedesktop.login1
Revert "units: lock down logind with fs namespacing options"
2018-11-14 19:03:33 +03:00
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
ExecStart=@rootlibexecdir@/systemd-logind
FileDescriptorStoreMax=512
IPAddressDeny=any
LockPersonality=yes
units: enable MemoryDenyWriteExecute (#3459) Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute. Closes: #3459
2016-06-08 15:23:37 +03:00
MemoryDenyWriteExecute=yes
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
NoNewPrivileges=yes
units: enable ProtectHostname=yes
2019-02-19 01:30:12 +03:00
ProtectHostname=yes
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
Restart=always
RestartSec=0
unit: tighten sandboxing for logind
2018-04-27 12:11:29 +03:00
RestrictAddressFamilies=AF_UNIX AF_NETLINK
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
RestrictNamespaces=yes
RestrictRealtime=yes
units: set SystemCallArchitectures=native on all our long-running services
2017-02-09 00:32:37 +03:00
SystemCallArchitectures=native
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
WatchdogSec=3min
units: increase LimitNOFILE a bit since we need one fd per session (for logind) and one fd per service (for stdout-syslog-bridge) increase the default rlimit a bit.
2011-10-11 06:43:29 +04:00
units: bump the RLIMIT_NOFILE soft limit for all services that access the journal This updates the unit files of all our serviecs that deal with journal stuff to use a higher RLIMIT_NOFILE soft limit by default. The new value is the same as used for the new HIGH_RLIMIT_NOFILE we just added. With this we ensure all code that access the journal has higher RLIMIT_NOFILE. The code that runs as daemon via the unit files, the code that is run from the user's command line via C code internal to the relevant tools. In some cases this means we'll redundantly bump the limits as there are tools run both from the command line and as service.
2018-10-01 19:08:27 +03:00
# Increase the default a bit in order to allow many simultaneous logins since
# we keep one fd open per session.
meson: define @HIGH_RLIMIT_NOFILE@ and use it everywhere
2018-10-17 11:21:48 +03:00
LimitNOFILE=@HIGH_RLIMIT_NOFILE@
Copy Permalink