shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-01 00:51:24 +03:00
Code
ab0fc8711b
systemd/units/systemd-journald.service.in

40 lines
1.5 KiB
SYSTEMD
Raw Normal View History

journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 02:20:58 +04:00
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
# (at your option) any later version.
[Unit]
Description=Journal Service
units: fix man section
2012-06-01 19:26:28 +04:00
Documentation=man:systemd-journald.service(8) man:journald.conf(5)
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
DefaultDependencies=no
Requires=systemd-journald.socket
journald: if available pull audit messages from the kernel into journal logs
2014-11-03 22:58:24 +03:00
After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket syslog.socket
unit: make sure structured logging is available before we enter the main boot phase
2012-08-25 01:18:35 +04:00
Before=sysinit.target
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
[Service]
units: make systemd-journald.service Type=notify It already calls sd_notify(), so it looks like an oversight. Without it, its ordering to systemd-journal-flush.service is non-deterministic and the SIGUSR1 from flushing may kill journald before it has its signal handlers set up. https://bugs.freedesktop.org/show_bug.cgi?id=85871 https://bugzilla.redhat.com/show_bug.cgi?id=1159641
2014-11-04 22:28:08 +03:00
Type=notify
journald: if available pull audit messages from the kernel into journal logs
2014-11-03 22:58:24 +03:00
Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
ExecStart=@rootlibexecdir@/systemd-journald
units: automatically respawn the core services
2012-06-28 14:13:52 +04:00
Restart=always
units: don't enforce a holdoff time for journald, logind, udevd These services should be restarted as quickly as possible if they fail, and the extra safety net of the holdoff time is not necessary.
2012-07-18 04:31:52 +04:00
RestartSec=0
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
StandardOutput=null
journal: restore watchdog support
2015-11-03 14:28:19 +03:00
WatchdogSec=3min
journald: make sure we retain all stream fds across restarts (#6348) Currently we set 4096 as maximum for number of stream connections that we accept. However maximum number of file descriptors that systemd is willing to accept from us is just 1024. This means we can't retain all stream connections that we accepted. Hence bump the limit of fds in a unit file so that systemd holds open all stream fds while we are restarted. New limit is set to 4224 (4096 + 128).
2017-07-17 11:04:37 +03:00
FileDescriptorStoreMax=4224
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
units: enable MemoryDenyWriteExecute (#3459) Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute. Closes: #3459
2016-06-08 15:23:37 +03:00
MemoryDenyWriteExecute=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
RestrictRealtime=yes
units: restrict namespace for a good number of our own services Basically, we turn it on for most long-running services, with the exception of machined (whose child processes need to join containers here and there), and importd (which sandboxes tar in a CLONE_NEWNET namespace). machined is left unrestricted, and importd is restricted to use only "net"
2017-02-09 12:28:23 +03:00
RestrictNamespaces=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
RestrictAddressFamilies=AF_UNIX AF_NETLINK
units: make use of @reboot and @swap in our long-running service SystemCallFilter= settings Tighten security up a bit more.
2017-02-09 13:22:08 +03:00
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
units: set SystemCallArchitectures=native on all our long-running services
2017-02-09 00:32:37 +03:00
SystemCallArchitectures=native
units: set LockPersonality= for all our long-running services (#6819) Let's lock things down. Also, using it is the only way how to properly test this to the fullest extent.
2017-09-14 20:45:40 +03:00
LockPersonality=yes
units: prohibit all IP traffic on all our long-running services (#6921) Let's lock things down further.
2017-10-04 15:16:28 +03:00
IPAddressDeny=any
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
# Increase the default a bit in order to allow many simultaneous
journal: bump RLIMIT_NOFILE when journal files to 16K (if possible) When there are a lot of split out journal files, we might run out of fds quicker then we want. Hence: bump RLIMIT_NOFILE to 16K if possible. Do these even for journalctl. On Fedora the soft RLIMIT_NOFILE is at 1K, the hard at 4K by default for normal user processes, this code hence bumps this up for users to 4K. https://bugzilla.redhat.com/show_bug.cgi?id=1179980
2015-01-08 05:17:50 +03:00
# services being run since we keep one fd open per service. Also, when
# flushing journal files to disk, we might need a lot of fds when many
# journal files are combined.
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
LimitNOFILE=16384
Copy Permalink