shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-01 17:51:22 +03:00
Code
40093ce5dd
systemd/units/systemd-resolved.service.m4.in

35 lines
1.2 KiB
Plaintext
Raw Normal View History

networkd: add missing files
2014-05-16 22:14:23 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
resolved: add daemon to manage resolv.conf Also remove the equivalent functionality from networkd.
2014-05-19 00:10:48 +04:00
[Unit]
Description=Network Name Resolution
Documentation=man:systemd-resolved.service(8)
man: link some unit files to their online bus API documentation
2016-02-23 18:24:01 +03:00
Documentation=http://www.freedesktop.org/wiki/Software/systemd/resolved
Documentation=http://www.freedesktop.org/wiki/Software/systemd/writing-network-configuration-managers
Documentation=http://www.freedesktop.org/wiki/Software/systemd/writing-resolver-clients
units: fix typo in systemd-resolved.service There's no network.service unit, we actually mean network.target here. Reported by Fco. Eduardo Ramírez.
2015-05-14 23:32:35 +03:00
After=systemd-networkd.service network.target
resolved: add daemon to manage resolv.conf Also remove the equivalent functionality from networkd.
2014-05-19 00:10:48 +04:00
units: make resolved pull in its own .busname unit, but only on kdbus systems The daemon requires the busname unit to operate, since it contains the policy that allows it to acquire its service name.
2015-01-08 00:19:02 +03:00
# On kdbus systems we pull in the busname explicitly, because it
# carries policy that allows the daemon to acquire its name.
Wants=org.freedesktop.resolve1.busname
After=org.freedesktop.resolve1.busname
resolved: add daemon to manage resolv.conf Also remove the equivalent functionality from networkd.
2014-05-19 00:10:48 +04:00
[Service]
Type=notify
Restart=always
RestartSec=0
ExecStart=@rootlibexecdir@/systemd-resolved
resolved: run as unpriviliged "systemd-resolve" user This service is not yet network facing, but let's prepare nonetheless. Currently all caps are dropped, but some may need to be kept in the future.
2014-06-02 01:01:20 +04:00
CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER
core: rename ReadOnlySystem= to ProtectSystem= and add a third value for also mounting /etc read-only Also, rename ProtectedHome= to ProtectHome=, to simplify things a bit. With this in place we now have two neat options ProtectSystem= and ProtectHome= for protecting the OS itself (and optionally its configuration), and for protecting the user's data.
2014-06-04 20:07:55 +04:00
ProtectSystem=full
ProtectHome=yes
units: increase watchdog timeout to 3min for all our services Apparently, disk IO issues are more frequent than we hope, and 1min waiting for disk IO happens, so let's increase the watchdog timeout a bit, for all our services. See #1353 for an example where this triggers.
2015-09-23 18:27:39 +03:00
WatchdogSec=3min
units: enable MemoryDenyWriteExecute (#3459) Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute. Closes: #3459
2016-06-08 15:23:37 +03:00
MemoryDenyWriteExecute=yes
units: add a basic SystemCallFilter (#3471) Add a line SystemCallFilter=~@clock @module @mount @obsolete @raw-io ptrace for daemons shipped by systemd. As an exception, systemd-timesyncd needs @clock system calls and systemd-localed is not privileged. ptrace(2) is blocked to prevent seccomp escapes.
2016-06-09 10:32:04 +03:00
SystemCallFilter=~@clock @module @mount @obsolete @raw-io ptrace
resolved: add daemon to manage resolv.conf Also remove the equivalent functionality from networkd.
2014-05-19 00:10:48 +04:00
[Install]
WantedBy=multi-user.target
Copy Permalink