shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-01 00:51:24 +03:00
Code
357f5b07ae
systemd/units/systemd-networkd.service.in

64 lines
2.1 KiB
SYSTEMD
Raw Normal View History

license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 07:23:58 +03:00
# SPDX-License-Identifier: LGPL-2.1-or-later
Add SPDX license headers to unit files
2017-11-18 19:35:03 +03:00
#
networkd: add a basic network daemon This daemon listens for and configures network devices tagged with 'systemd-networkd'. By default, no devices are tagged so this daemon can safely run in parallel with existing network daemons/scripts. Networks are configured in /etc/systemd/network/*.network. The first .network file that matches a given link is applied. The matching logic is similar to the one for .link files, but additionally supports matching on interface name. The mid-term aim is to provide an alternative to ad-hoc scripts currently used in initrd's and for wired setups that don't change much (e.g., as seen on servers/and some embedded systems). Currently, static addresses and a gateway can be configured. Example .network file: [Match] Name=wlp2s0 [Network] Description=My Network Gateway=192.168.1.1 Address=192.168.1.23/24 Address=fe80::9aee:94ff:fe3f:c618/64
2013-10-17 05:18:36 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
Description=Network Service
Documentation=man:systemd-networkd.service(8)
units: minor cleanups
2014-06-17 04:18:33 +04:00
ConditionCapability=CAP_NET_ADMIN
networkd: add a basic network daemon This daemon listens for and configures network devices tagged with 'systemd-networkd'. By default, no devices are tagged so this daemon can safely run in parallel with existing network daemons/scripts. Networks are configured in /etc/systemd/network/*.network. The first .network file that matches a given link is applied. The matching logic is similar to the one for .link files, but additionally supports matching on interface name. The mid-term aim is to provide an alternative to ad-hoc scripts currently used in initrd's and for wired setups that don't change much (e.g., as seen on servers/and some embedded systems). Currently, static addresses and a gateway can be configured. Example .network file: [Match] Name=wlp2s0 [Network] Description=My Network Gateway=192.168.1.1 Address=192.168.1.23/24 Address=fe80::9aee:94ff:fe3f:c618/64
2013-10-17 05:18:36 +04:00
DefaultDependencies=no
networkd: allow networkd to start in early boot With the previous improvements, networkd.service's "After=dbus.service" can now be dropped. That ordering effectively forced networkd.service to run in late boot only (dbus.service was rejected to run in early boot in https://bugs.freedesktop.org/show_bug.cgi?id=98254). Fixes #4504
2016-11-22 10:41:51 +03:00
# systemd-udevd.service can be dropped once tuntap is moved to netlink
networkd: use socket activation when starting networkd Add After=systemd-networkd.socket to avoid a race condition and networkd falling back to the non-socket activation code. Also add Wants=systemd-networkd.socket, so the socket is started when networkd is started via `systemctl start systemd-networkd.service`. A Requires is not strictly necessary, as networkd still ships the non-socket activation code. Should this code be removed one day, the Wants should be bumped to Requires accordingly. See also 5544ee85163733eaa50f598fcf3bd9421d4a42f9. Fixes: #16809
2020-08-26 17:54:45 +03:00
After=systemd-networkd.socket systemd-udevd.service network-pre.target systemd-sysusers.service systemd-sysctl.service
units: minor cleanups
2014-06-17 04:18:33 +04:00
Before=network.target multi-user.target shutdown.target
Conflicts=shutdown.target
networkd: use socket activation when starting networkd Add After=systemd-networkd.socket to avoid a race condition and networkd falling back to the non-socket activation code. Also add Wants=systemd-networkd.socket, so the socket is started when networkd is started via `systemctl start systemd-networkd.service`. A Requires is not strictly necessary, as networkd still ships the non-socket activation code. Should this code be removed one day, the Wants should be bumped to Requires accordingly. See also 5544ee85163733eaa50f598fcf3bd9421d4a42f9. Fixes: #16809
2020-08-26 17:54:45 +03:00
Wants=systemd-networkd.socket network.target
networkd: add a basic network daemon This daemon listens for and configures network devices tagged with 'systemd-networkd'. By default, no devices are tagged so this daemon can safely run in parallel with existing network daemons/scripts. Networks are configured in /etc/systemd/network/*.network. The first .network file that matches a given link is applied. The matching logic is similar to the one for .link files, but additionally supports matching on interface name. The mid-term aim is to provide an alternative to ad-hoc scripts currently used in initrd's and for wired setups that don't change much (e.g., as seen on servers/and some embedded systems). Currently, static addresses and a gateway can be configured. Example .network file: [Match] Name=wlp2s0 [Network] Description=My Network Gateway=192.168.1.1 Address=192.168.1.23/24 Address=fe80::9aee:94ff:fe3f:c618/64
2013-10-17 05:18:36 +04:00
[Service]
units: make use of !! ExecStart= prefix in systemd-networkd.service Let's make use of !! to run networkd with ambient capabilities on systems supporting them.
2017-08-26 19:40:47 +03:00
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
unit: declare BusName= in all our units that are on the bus, event if they don't use Type=dbus This information is always useful, so let's always declare it, particular in the light of #16976.
2020-09-11 11:56:06 +03:00
BusName=org.freedesktop.network1
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
units: deny access to block devices While the need for access to character devices can be tricky to determine for the general case, it's obvious that most of our services have no need to access block devices. For logind and timedated this can be tightened further.
2019-05-01 15:28:36 +03:00
DeviceAllow=char-* rw
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
ExecStart=!!{{ROOTLIBEXECDIR}}/systemd-networkd
unit: make systemd-networkd.service support reload command
2020-12-08 18:21:58 +03:00
ExecReload=networkctl reload
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
units: turn on ProtectProc= wherever suitable
2020-08-06 15:50:38 +03:00
ProtectProc=invisible
units: add ProtectClock=yes Add `ProtectClock=yes` to systemd units. Since it implies certain `DeviceAllow=` rules, make sure that the units have `DeviceAllow=` rules so they are still able to access other devices. Exclude timesyncd and timedated.
2020-04-02 21:18:11 +03:00
ProtectClock=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
ProtectControlGroups=yes
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
ProtectHome=yes
units: set ProtectKernelLogs=yes on relevant units We set ProtectKernelLogs=yes on all long running services except for udevd, since it accesses /dev/kmsg, and journald, since it calls syslog and accesses /dev/kmsg.
2019-11-14 03:56:23 +03:00
ProtectKernelLogs=yes
units: turn on ProtectProc= wherever suitable
2020-08-06 15:50:38 +03:00
ProtectKernelModules=yes
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
ProtectSystem=strict
Restart=on-failure
units: turn on ProtectProc= wherever suitable
2020-08-06 15:50:38 +03:00
RestartKillSignal=SIGUSR2
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
RestartSec=0
unit: add AF_ALG to systemd-networkd.service networkd uses khash, and khash requires AF_ALG.
2020-01-26 15:24:09 +03:00
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET AF_ALG
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
RestrictNamespaces=yes
RestrictRealtime=yes
units: turn on RestrictSUIDSGID= in most of our long-running daemons
2019-03-20 21:52:20 +03:00
RestrictSUIDSGID=yes
units: make use of !! ExecStart= prefix in systemd-networkd.service Let's make use of !! to run networkd with ambient capabilities on systems supporting them.
2017-08-26 19:40:47 +03:00
RuntimeDirectory=systemd/netif
RuntimeDirectoryPreserve=yes
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
Type=notify
User=systemd-network
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
{{SERVICE_WATCHDOG}}
install: do not statically enable systemd-networkd [tomegun: pruned the commit message as not to contradict the follow-up commit]
2014-02-21 07:38:17 +04:00
[Install]
WantedBy=multi-user.target
networkd: support socket activation Still keep the non-socket activation code around for starting from the commandline, but will likely drop that too in the future.
2015-02-02 00:13:26 +03:00
Also=systemd-networkd.socket
Makefile.am: link dbus-org.freedesktop.network1 alias in /etc This makes dbus-org.freedesktop.network1.service like dbus-org.freedesktop.resolve1.service. When systemd-networkd.service is disabled, the alias is also removed.
2017-04-10 18:59:58 +03:00
Alias=dbus-org.freedesktop.network1.service
units: make enablement of s-n-wait-online.service follow systemd-networkd.service (#5635) In 58a6dd15582c038a25bd7059435833943e2e4617 s-n-wait-online.service was added to presets to synchronize the presets with the state after installation. But it is harmful to have s-n-wait-online.service enabled when s-n.service is disabled, because s-n-wait-online.service has Requsite=s-n.service and cannot be activated. Thus remove s-n-wait-online.service from presets again, and let it be enabled whenever s-n.service is enabled. During installation we create enablement symlinks by hand, and since s-n.service is enabled, s-n-w-o.service should be enabled too, so the symlink should still be created during installation. https://bugzilla.redhat.com/show_bug.cgi?id=1433459#c15
2017-03-27 13:55:55 +03:00
# We want to enable systemd-networkd-wait-online.service whenever this service
# is enabled. systemd-networkd-wait-online.service has
# WantedBy=network-online.target, so enabling it only has an effect if
# network-online.target itself is enabled or pulled in by some other unit.
Also=systemd-networkd-wait-online.service
Copy Permalink