systemd/units/systemd-bus-proxyd@.service.m4.in

#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Legacy D-Bus Protocol Compatibility Daemon

[Service]
# The first argument will be replaced by the service by information on
# the process requesting the proxy, we need a placeholder to keep the
# space available for this.
ExecStart=@rootlibexecdir@/systemd-bus-proxyd --drop-privileges --address=kernel:path=/sys/fs/kdbus/0-system/bus xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
NotifyAccess=main
CapabilityBoundingSet=CAP_IPC_OWNER CAP_SETUID CAP_SETGID CAP_SETPCAP m4_ifdef(`HAVE_SMACK', CAP_MAC_ADMIN )
PrivateTmp=yes
PrivateDevices=yes
PrivateNetwork=yes
ProtectSystem=full
ProtectHome=yes
bus: install systemd-bus-proxyd unit files for compatibility with dbus1 2013-12-13 23:29:35 +04:00			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

bus: fix typo in systemd-bus-proxyd 2013-12-17 02:25:32 +04:00			`[Unit]`
bus: install systemd-bus-proxyd unit files for compatibility with dbus1 2013-12-13 23:29:35 +04:00			`Description=Legacy D-Bus Protocol Compatibility Daemon`

			`[Service]`
bus: send status message from proxyd to systemd about client we are working for 2013-12-21 07:19:51 +04:00			`# The first argument will be replaced by the service by information on`
			`# the process requesting the proxy, we need a placeholder to keep the`
			`# space available for this.`
bus-proxy: automatically detect scope of bus and derive which XML snippets to load from that 2014-11-28 18:14:39 +03:00			`ExecStart=@rootlibexecdir@/systemd-bus-proxyd --drop-privileges --address=kernel:path=/sys/fs/kdbus/0-system/bus xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`
bus: send status message from proxyd to systemd about client we are working for 2013-12-21 07:19:51 +04:00			`NotifyAccess=main`
bus-proxy: cloning smack label When dbus client connects to systemd-bus-proxyd through Unix domain socket proxy takes client's smack label and sets for itself. It is done before and independent of dropping privileges. The reason of such soluton is fact that tests of access rights performed by lsm may take place inside kernel, not only in userspace of recipient of message. The bus-proxyd needs CAP_MAC_ADMIN to manipulate its label. In case of systemd running in system mode, CAP_MAC_ADMIN should be added to CapabilityBoundingSet in service file of bus-proxyd. In case of systemd running in user mode ('systemd --user') it can be achieved by addition Capabilities=cap_mac_admin=i and SecureBits=keep-caps to user@.service file and setting cap_mac_admin+ei on bus-proxyd binary. 2014-12-09 14:17:24 +03:00			CapabilityBoundingSet=CAP_IPC_OWNER CAP_SETUID CAP_SETGID CAP_SETPCAP m4_ifdef(`HAVE_SMACK', CAP_MAC_ADMIN )
units: make use of PrivateTmp=yes and PrivateDevices=yes for all our long-running daemons 2014-03-19 19:45:28 +04:00			`PrivateTmp=yes`
			`PrivateDevices=yes`
core: enable PrivateNetwork= for a number of our long running services where this is useful 2014-03-20 02:08:39 +04:00			`PrivateNetwork=yes`
core: rename ReadOnlySystem= to ProtectSystem= and add a third value for also mounting /etc read-only Also, rename ProtectedHome= to ProtectHome=, to simplify things a bit. With this in place we now have two neat options ProtectSystem= and ProtectHome= for protecting the OS itself (and optionally its configuration), and for protecting the user's data. 2014-06-04 20:07:55 +04:00			`ProtectSystem=full`
			`ProtectHome=yes`