shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-12-22 17:35:35 +03:00
Code
33c15ba8e8
systemd/units/systemd-homed.service.in

45 lines
1.4 KiB
SYSTEMD
Raw Normal View History

license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 07:23:58 +03:00
# SPDX-License-Identifier: LGPL-2.1-or-later
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
#
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
homed: replace "home directory" with "home area" in a few places
2020-03-11 15:07:10 +03:00
Description=Home Area Manager
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
Documentation=man:systemd-homed.service(8)
man,units: link to the new dbus-api man pages
2020-09-29 09:03:10 +03:00
Documentation=man:org.freedesktop.home1(5)
homed: stop before stopping dbus Otherwise, systemd-homed-active.service will fail to deactivate all homes because homectl can no longer talk to homed if dbus stops first. As a result, /home cannot be umounted. Doing this on systemd-homed-active.service instead works as well, but systemd-homed will exit 1 if dbus is already shut down.
2022-01-04 15:56:11 +03:00
After=home.mount dbus.service
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
[Service]
BusName=org.freedesktop.home1
units: relax sandbox so that uidmap stuff can work The uidmap suff requires additional caps and userns to work in some cases. Allow it. Follow-up for: 1147c538bbb6a2d3d5ba2e40f1437bcbeb22b33e
2021-11-15 18:21:59 +03:00
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE CAP_SETPCAP CAP_DAC_READ_SEARCH CAP_SETFCAP
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
DeviceAllow=/dev/loop-control rw
DeviceAllow=/dev/mapper/control rw
systemd-homed: Give access to /dev/btrfs-control Otherwise, we see "WARNING: failed to open /dev/btrfs-control, skipping device registration: Operation not permitted" in systemd-homed's logs when creating a btrfs on luks home.
2024-12-21 19:52:03 +03:00
DeviceAllow=/dev/btrfs-control rw
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
DeviceAllow=block-* rw
homed: allow systemd-homed access to FIDO2 devices Add DeviceAllow= option for FIDO2 devices in systemd-homed.service.
2021-07-12 20:57:43 +03:00
DeviceAllow=char-hidraw rw
Drop split-usr and unmerged-usr support As previously announced, execute order 66: https://lists.freedesktop.org/archives/systemd-devel/2022-September/048352.html The meson options split-usr, rootlibdir and rootprefix become no-ops that print a warning if they are set to anything other than the default values. We can remove them in a future release.
2023-06-12 04:15:19 +03:00
ExecStart={{LIBEXECDIR}}/systemd-homed
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
KillMode=mixed
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
LimitNOFILE={{HIGH_RLIMIT_NOFILE}}
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
homed: add missing capabilities for SMB/CIFS backend In 2020 mount.cifs started to require a bunch for caps to work. let's add them to the capability bounding set. Also, SMB support obviously needs network access, hence open that up. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1962920
2021-08-31 11:04:06 +03:00
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_ALG AF_INET AF_INET6
units: relax sandbox so that uidmap stuff can work The uidmap suff requires additional caps and userns to work in some cases. Allow it. Follow-up for: 1147c538bbb6a2d3d5ba2e40f1437bcbeb22b33e
2021-11-15 18:21:59 +03:00
RestrictNamespaces=mnt user
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
RestrictRealtime=yes
StateDirectory=systemd/home
homed: Create & advertise blob directory This ensures that a user-specific blob directory exists in /var/cache/systemd/homed for as long as the user exists, and gets deleted if the user gets deleted. It also advertises this blob directory via the user record, so that clients can find and use it.
2024-01-09 02:37:52 +03:00
CacheDirectory=systemd/home
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
systemd-homed.service.in: add quotactl to SystemCallFilter Standard directories make a call to the quotactl system call to enforce disk size limits. Fixes #30287
2023-12-01 19:29:32 +03:00
SystemCallFilter=@system-service @mount quotactl
units: prolong the stop timeout for homed Let's give IO/resizing/… more time then usual. Fixes: #22901
2022-09-05 16:15:36 +03:00
TimeoutStopSec=3min
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
{{SERVICE_WATCHDOG}}
units: make systemd-homed.service installable Fixes #15083. Users might want to disable homed if not used to save resources.
2020-03-13 20:38:09 +03:00
[Install]
WantedBy=multi-user.target
Alias=dbus-org.freedesktop.home1.service
presets: Don't enable systemd-homed-firstboot.service by default Enabling this service by default means every CI image without a regular user now gets stuck on first boot due to the password prompt from systemd-homed-firstboot.service. Let's not enable the service by default but instead require users to enable it explicitly if they want its behavior. Fixes #33249
2024-06-07 18:21:48 +03:00
Also=systemd-homed-activate.service
Copy Permalink