shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-01 17:51:22 +03:00
Code
93caec7ed6
systemd/units/systemd-journald@.service.in

44 lines
1.4 KiB
SYSTEMD
Raw Normal View History

license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 07:23:58 +03:00
# SPDX-License-Identifier: LGPL-2.1-or-later
units: add unit files for instantiated journal daemons
2019-11-25 17:37:35 +03:00
#
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
Description=Journal Service for Namespace %i
Documentation=man:systemd-journald.service(8) man:journald.conf(5)
journald: add ability to activate by varlink socket If we have exit on idle, then operations such as "journalctl --namespace=foo --rotate" should work even if the journal daemon is currently not running. (Note that we don't do activation by varlink for the main instance of journald, I am not sure the deadlocks it might introduce are worth it)
2019-11-27 16:47:37 +03:00
Requires=systemd-journald@%i.socket systemd-journald-varlink@%i.socket
After=systemd-journald@%i.socket systemd-journald-varlink@%i.socket
units: add unit files for instantiated journal daemons
2019-11-25 17:37:35 +03:00
[Service]
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
DevicePolicy=closed
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
ExecStart={{ROOTLIBEXECDIR}}/systemd-journald %i
units: add unit files for instantiated journal daemons
2019-11-25 17:37:35 +03:00
FileDescriptorStoreMax=4224
Group=systemd-journal
IPAddressDeny=any
LockPersonality=yes
LogsDirectory=journal/%m.%i
LogsDirectoryMode=02755
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RuntimeDirectory=systemd/journal.%i
RuntimeDirectoryPreserve=yes
Sockets=systemd-journald@%i.socket
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
Type=notify
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
{{SERVICE_WATCHDOG}}
units: add unit files for instantiated journal daemons
2019-11-25 17:37:35 +03:00
# If there are many split up journal files we need a lot of fds to access them
# all in parallel.
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
LimitNOFILE={{HIGH_RLIMIT_NOFILE}}
Copy Permalink