shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-01 09:21:26 +03:00
Code
5918a93355
systemd/units/systemd-userdbd.service.in

46 lines
1.2 KiB
SYSTEMD
Raw Normal View History

license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 07:23:58 +03:00
# SPDX-License-Identifier: LGPL-2.1-or-later
userdbd: add new service that can merge userdb queries from multiple clients
2019-07-04 19:33:30 +03:00
#
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
Description=User Database Manager
Documentation=man:systemd-userdbd.service(8)
Requires=systemd-userdbd.socket
After=systemd-userdbd.socket
Before=sysinit.target
DefaultDependencies=no
[Service]
CapabilityBoundingSet=CAP_DAC_READ_SEARCH
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
ExecStart={{ROOTLIBEXECDIR}}/systemd-userdbd
userdbd: add new service that can merge userdb queries from multiple clients
2019-07-04 19:33:30 +03:00
IPAddressDeny=any
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
LimitNOFILE={{HIGH_RLIMIT_NOFILE}}
userdbd: add new service that can merge userdb queries from multiple clients
2019-07-04 19:33:30 +03:00
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
units: turn on ProtectProc= wherever suitable
2020-08-06 15:50:38 +03:00
ProtectProc=invisible
userdbd: add new service that can merge userdb queries from multiple clients
2019-07-04 19:33:30 +03:00
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectSystem=strict
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
Type=notify
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
{{SERVICE_WATCHDOG}}
units: make systemd-userdbd.{socket,service} installable It's lightweight and generally useful, so it should be enabled by default. But users might want to disable it for whatever reason, and things should be fine without it, so let's make it installable so it can be disabled if wanted. Fixes #15175.
2020-03-13 20:40:54 +03:00
[Install]
Also=systemd-userdbd.socket
Copy Permalink