shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-12-26 03:22:00 +03:00
Code
a0dd209763
systemd/units/systemd-journal-upload.service.in

39 lines
1.1 KiB
SYSTEMD
Raw Normal View History

journal-remote: add units and read certs from default locations
2014-03-31 07:08:02 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
Description=Journal Remote Upload Service
journal-remote: add documents in the unit files
2015-12-15 04:51:12 +03:00
Documentation=man:systemd-journal-upload(8)
units: journal-upload Wants= and After=network-online.target (#4354) To upload journal entries to a remote server, it is required that the network is online.
2016-10-12 12:13:13 +03:00
Wants=network-online.target
After=network-online.target
journal-remote: add units and read certs from default locations
2014-03-31 07:08:02 +04:00
[Service]
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state
journal-remote: add units and read certs from default locations
2014-03-31 07:08:02 +04:00
User=systemd-journal-upload
unit: enable DynamicUser= for journal-upload
2017-10-06 10:06:21 +03:00
DynamicUser=yes
journal-remote: add SupplementaryGroups to systemd-journal-upload.service
2016-01-15 09:25:36 +03:00
SupplementaryGroups=systemd-journal
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
WatchdogSec=3min
journal-remote: add units and read certs from default locations
2014-03-31 07:08:02 +04:00
PrivateDevices=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
ProtectHome=yes
ProtectControlGroups=yes
ProtectKernelTunables=yes
units: turn on ProtectKernelModules= for most long-running services
2017-02-09 13:09:50 +03:00
ProtectKernelModules=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
units: restrict namespace for a good number of our own services Basically, we turn it on for most long-running services, with the exception of machined (whose child processes need to join containers here and there), and importd (which sandboxes tar in a CLONE_NEWNET namespace). machined is left unrestricted, and importd is restricted to use only "net"
2017-02-09 12:28:23 +03:00
RestrictNamespaces=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
units: set SystemCallArchitectures=native on all our long-running services
2017-02-09 00:32:37 +03:00
SystemCallArchitectures=native
units: set LockPersonality= for all our long-running services (#6819) Let's lock things down. Also, using it is the only way how to properly test this to the fullest extent.
2017-09-14 20:45:40 +03:00
LockPersonality=yes
units: use {State,Logs}Directory= if they are applicable
2017-08-02 11:35:11 +03:00
StateDirectory=systemd/journal-upload
journal-remote: add units and read certs from default locations
2014-03-31 07:08:02 +04:00
journal: bump RLIMIT_NOFILE when journal files to 16K (if possible) When there are a lot of split out journal files, we might run out of fds quicker then we want. Hence: bump RLIMIT_NOFILE to 16K if possible. Do these even for journalctl. On Fedora the soft RLIMIT_NOFILE is at 1K, the hard at 4K by default for normal user processes, this code hence bumps this up for users to 4K. https://bugzilla.redhat.com/show_bug.cgi?id=1179980
2015-01-08 05:17:50 +03:00
# If there are many split up journal files we need a lot of fds to
# access them all and combine
LimitNOFILE=16384
journal-remote: add units and read certs from default locations
2014-03-31 07:08:02 +04:00
[Install]
WantedBy=multi-user.target
Copy Permalink