systemd/units/systemd-journald.service.in

#  SPDX-License-Identifier: LGPL-2.1+
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Journal Service
Documentation=man:systemd-journald.service(8) man:journald.conf(5)
DefaultDependencies=no
Requires=systemd-journald.socket
After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket syslog.socket
Before=sysinit.target

[Service]
Type=notify
Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket
ExecStart=@rootlibexecdir@/systemd-journald
Restart=always
RestartSec=0
StandardOutput=null
WatchdogSec=3min
FileDescriptorStoreMax=4224
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictNamespaces=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
SystemCallArchitectures=native
LockPersonality=yes
IPAddressDeny=any

# Increase the default a bit in order to allow many simultaneous
# services being run since we keep one fd open per service. Also, when
# flushing journal files to disk, we might need a lot of fds when many
# journal files are combined.
LimitNOFILE=16384
Add SPDX license headers to unit files 2017-11-18 19:35:03 +03:00			`# SPDX-License-Identifier: LGPL-2.1+`
			`#`
journal: add unit files and shared library glue 2011-12-30 20:50:37 +04:00			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends. 2012-04-12 02:20:58 +04:00			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
journal: add unit files and shared library glue 2011-12-30 20:50:37 +04:00			`# (at your option) any later version.`

			`[Unit]`
			`Description=Journal Service`
units: fix man section 2012-06-01 19:26:28 +04:00			`Documentation=man:systemd-journald.service(8) man:journald.conf(5)`
journal: add unit files and shared library glue 2011-12-30 20:50:37 +04:00			`DefaultDependencies=no`
			`Requires=systemd-journald.socket`
journald: if available pull audit messages from the kernel into journal logs 2014-11-03 22:58:24 +03:00			`After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket syslog.socket`
unit: make sure structured logging is available before we enter the main boot phase 2012-08-25 01:18:35 +04:00			`Before=sysinit.target`
journal: add unit files and shared library glue 2011-12-30 20:50:37 +04:00
			`[Service]`
units: make systemd-journald.service Type=notify It already calls sd_notify(), so it looks like an oversight. Without it, its ordering to systemd-journal-flush.service is non-deterministic and the SIGUSR1 from flushing may kill journald before it has its signal handlers set up. https://bugs.freedesktop.org/show_bug.cgi?id=85871 https://bugzilla.redhat.com/show_bug.cgi?id=1159641 2014-11-04 22:28:08 +03:00			`Type=notify`
journald: if available pull audit messages from the kernel into journal logs 2014-11-03 22:58:24 +03:00			`Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket`
journal: add unit files and shared library glue 2011-12-30 20:50:37 +04:00			`ExecStart=@rootlibexecdir@/systemd-journald`
units: automatically respawn the core services 2012-06-28 14:13:52 +04:00			`Restart=always`
units: don't enforce a holdoff time for journald, logind, udevd These services should be restarted as quickly as possible if they fail, and the extra safety net of the holdoff time is not necessary. 2012-07-18 04:31:52 +04:00			`RestartSec=0`
journal: add unit files and shared library glue 2011-12-30 20:50:37 +04:00			`StandardOutput=null`
journal: restore watchdog support 2015-11-03 14:28:19 +03:00			`WatchdogSec=3min`
journald: make sure we retain all stream fds across restarts (#6348) Currently we set 4096 as maximum for number of stream connections that we accept. However maximum number of file descriptors that systemd is willing to accept from us is just 1024. This means we can't retain all stream connections that we accepted. Hence bump the limit of fds in a unit file so that systemd holds open all stream fds while we are restarted. New limit is set to 4224 (4096 + 128). 2017-07-17 11:04:37 +03:00			`FileDescriptorStoreMax=4224`
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS. 2016-08-26 14:23:27 +03:00			`CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE`
units: enable MemoryDenyWriteExecute (#3459) Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute. Closes: #3459 2016-06-08 15:23:37 +03:00			`MemoryDenyWriteExecute=yes`
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS. 2016-08-26 14:23:27 +03:00			`RestrictRealtime=yes`
units: restrict namespace for a good number of our own services Basically, we turn it on for most long-running services, with the exception of machined (whose child processes need to join containers here and there), and importd (which sandboxes tar in a CLONE_NEWNET namespace). machined is left unrestricted, and importd is restricted to use only "net" 2017-02-09 12:28:23 +03:00			`RestrictNamespaces=yes`
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS. 2016-08-26 14:23:27 +03:00			`RestrictAddressFamilies=AF_UNIX AF_NETLINK`
units: make use of @reboot and @swap in our long-running service SystemCallFilter= settings Tighten security up a bit more. 2017-02-09 13:22:08 +03:00			`SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap`
units: set SystemCallArchitectures=native on all our long-running services 2017-02-09 00:32:37 +03:00			`SystemCallArchitectures=native`
units: set LockPersonality= for all our long-running services (#6819) Let's lock things down. Also, using it is the only way how to properly test this to the fullest extent. 2017-09-14 20:45:40 +03:00			`LockPersonality=yes`
units: prohibit all IP traffic on all our long-running services (#6921) Let's lock things down further. 2017-10-04 15:16:28 +03:00			`IPAddressDeny=any`
journal: add unit files and shared library glue 2011-12-30 20:50:37 +04:00
			`# Increase the default a bit in order to allow many simultaneous`
journal: bump RLIMIT_NOFILE when journal files to 16K (if possible) When there are a lot of split out journal files, we might run out of fds quicker then we want. Hence: bump RLIMIT_NOFILE to 16K if possible. Do these even for journalctl. On Fedora the soft RLIMIT_NOFILE is at 1K, the hard at 4K by default for normal user processes, this code hence bumps this up for users to 4K. https://bugzilla.redhat.com/show_bug.cgi?id=1179980 2015-01-08 05:17:50 +03:00			`# services being run since we keep one fd open per service. Also, when`
			`# flushing journal files to disk, we might need a lot of fds when many`
			`# journal files are combined.`
journal: add unit files and shared library glue 2011-12-30 20:50:37 +04:00			`LimitNOFILE=16384`