shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-05 15:21:37 +03:00
Code
a44956c94a
systemd/units/systemd-journald.service.in

45 lines
1.5 KiB
SYSTEMD
Raw Normal View History

Add SPDX license headers to unit files
2017-11-18 19:35:03 +03:00
# SPDX-License-Identifier: LGPL-2.1+
#
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 02:20:58 +04:00
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
# (at your option) any later version.
[Unit]
Description=Journal Service
units: fix man section
2012-06-01 19:26:28 +04:00
Documentation=man:systemd-journald.service(8) man:journald.conf(5)
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
DefaultDependencies=no
Requires=systemd-journald.socket
journald: if available pull audit messages from the kernel into journal logs
2014-11-03 22:58:24 +03:00
After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket syslog.socket
unit: make sure structured logging is available before we enter the main boot phase
2012-08-25 01:18:35 +04:00
Before=sysinit.target
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
[Service]
journald: slightly bump OOM adjust for journald (#13366) If logging disappears issues are hard to debug, hence let's give journald a slight edge over other services when the OOM killer hits. Here are the special adjustments we now make: systemd-coredump@.service.in OOMScoreAdjust=500 systemd-journald.service.in OOMScoreAdjust=-250 systemd-udevd.service.in OOMScoreAdjust=-1000 (i.e. the coredump processing is made more likely to be killed on OOM, and udevd and journald are less likely to be killed)
2019-08-22 11:02:28 +03:00
OOMScoreAdjust=-250
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
units: deny access to block devices While the need for access to character devices can be tricky to determine for the general case, it's obvious that most of our services have no need to access block devices. For logind and timedated this can be tightened further.
2019-05-01 15:28:36 +03:00
DeviceAllow=char-* rw
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
ExecStart=@rootlibexecdir@/systemd-journald
journald: make sure we retain all stream fds across restarts (#6348) Currently we set 4096 as maximum for number of stream connections that we accept. However maximum number of file descriptors that systemd is willing to accept from us is just 1024. This means we can't retain all stream connections that we accepted. Hence bump the limit of fds in a unit file so that systemd holds open all stream fds while we are restarted. New limit is set to 4224 (4096 + 128).
2017-07-17 11:04:37 +03:00
FileDescriptorStoreMax=4224
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
IPAddressDeny=any
LockPersonality=yes
units: enable MemoryDenyWriteExecute (#3459) Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute. Closes: #3459
2016-06-08 15:23:37 +03:00
MemoryDenyWriteExecute=yes
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
NoNewPrivileges=yes
Restart=always
RestartSec=0
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
RestrictAddressFamilies=AF_UNIX AF_NETLINK
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
RestrictNamespaces=yes
RestrictRealtime=yes
units: turn on RestrictSUIDSGID= in most of our long-running daemons
2019-03-20 21:52:20 +03:00
RestrictSUIDSGID=yes
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket
StandardOutput=null
units: set SystemCallArchitectures=native on all our long-running services
2017-02-09 00:32:37 +03:00
SystemCallArchitectures=native
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
Type=notify
meson: allow WatchdogSec= in services to be configured As discussed on systemd-devel [1], in Fedora we get lots of abrt reports about the watchdog firing [2], but 100% of them seem to be caused by resource starvation in the machine, and never actual deadlocks in the services being monitored. Killing the services not only does not improve anything, but it makes the resource starvation worse, because the service needs cycles to restart, and coredump processing is also fairly expensive. This adds a configuration option to allow the value to be changed. If the setting is not set, there is no change. My plan is to set it to some ridiculusly high value, maybe 1h, to catch cases where a service is actually hanging. [1] https://lists.freedesktop.org/archives/systemd-devel/2019-October/043618.html [2] https://bugzilla.redhat.com/show_bug.cgi?id=1300212
2019-10-25 13:17:24 +03:00
@SERVICE_WATCHDOG@
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
units: bump the RLIMIT_NOFILE soft limit for all services that access the journal This updates the unit files of all our serviecs that deal with journal stuff to use a higher RLIMIT_NOFILE soft limit by default. The new value is the same as used for the new HIGH_RLIMIT_NOFILE we just added. With this we ensure all code that access the journal has higher RLIMIT_NOFILE. The code that runs as daemon via the unit files, the code that is run from the user's command line via C code internal to the relevant tools. In some cases this means we'll redundantly bump the limits as there are tools run both from the command line and as service.
2018-10-01 19:08:27 +03:00
# If there are many split up journal files we need a lot of fds to access them
# all in parallel.
meson: define @HIGH_RLIMIT_NOFILE@ and use it everywhere
2018-10-17 11:21:48 +03:00
LimitNOFILE=@HIGH_RLIMIT_NOFILE@
Copy Permalink