shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-12-23 21:35:11 +03:00
Code
aed4e90456
systemd/tmpfiles.d/systemd.conf.in

74 lines
3.2 KiB
Plaintext
Raw Normal View History

tmpfiles: install default tmpfiles configuration
2010-09-29 00:32:53 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 02:20:58 +04:00
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
tmpfiles: install default tmpfiles configuration
2010-09-29 00:32:53 +04:00
# (at your option) any later version.
tmpfiles: include reference to man page in tmpfiles files
2010-11-11 01:58:01 +03:00
# See tmpfiles.d(5) for details
tmpfiles: don't do automatic cleanup in $XDG_RUNTIME_DIR Now that logind will clean up all IPC resources of a user we should really consider $XDG_RUNTIME_DIR as just another kind of IPC with the same life-cycle logic as the other IPC resources. This should be safe now to do since every user gets his own $XDG_RUNTIME_DIR tmpfs instance with a fixed size limit, so that flooding of it will more effectively be averted.
2014-06-30 21:06:18 +04:00
d /run/user 0755 root root -
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 14:35:51 +03:00
{% if ENABLE_UTMP %}
tmpfiles.d: avoid deprecated, undocumented syntax (s/F/f+/) Fixes: eccebf4b0dcb ("systemd-tmpfiles: deprecate F for f+")
2024-02-27 16:21:33 +03:00
f+! /run/utmp 0664 root utmp -
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 14:35:51 +03:00
{% endif %}
tmpfiles: enforce new /var/lock semantics http://lists.freedesktop.org/archives/systemd-devel/2011-March/001823.html
2011-04-01 02:43:28 +04:00
path: optionally, create watched directories in .path units
2011-04-10 03:30:14 +04:00
d /run/systemd/ask-password 0755 root root -
sd-login: beef up login api, to add monitoring and enumerating
2011-07-22 23:01:15 +04:00
d /run/systemd/seats 0755 root root -
d /run/systemd/sessions 0755 root root -
d /run/systemd/users 0755 root root -
machined: split out machine registration stuff from logind Embedded folks don't need the machine registration stuff, hence it's nice to make this optional. Also, I'd expect that machinectl will grow additional commands quickly, for example to join existing containers and suchlike, hence it's better keeping that separate from loginctl.
2013-07-02 05:47:23 +04:00
d /run/systemd/machines 0755 root root -
shutdownd: rework interface, allow subscribing to scheduled shutdowns This extends the shutdownd interface to expose schedule shutdown information in /run/systemd/shutdown/schedule. This also cleans up the shutdownd protocol and documents it in a header file sd-shutdown.h. This is supposed to be used by client code that wants to control and monitor scheduled shutdown.
2012-04-11 04:04:46 +04:00
d /run/systemd/shutdown 0755 root root -
tmpfiles: write /run/nologin during early boot to disallow too early user logins systemd-user-sessoins.service will later on remove the flag file, thus permitting user logins when the time has come.
2012-06-25 19:35:13 +04:00
tmpfiles: explicitly set mode for /run/log
2014-06-30 21:53:10 +04:00
d /run/log 0755 root root -
tmpfiles: get rid of "m" lines, make them redundant by "z" "m" so far has been a non-globbing version of "z". Since this makes it quite redundant, let's get rid of it. Remove "m" from the man pages, beef up "z" docs instead, and make "m" nothing more than a compatibility alias for "z".
2014-06-11 01:42:16 +04:00
z /run/log/journal 2755 root systemd-journal - -
tmpfiles: don't allow read access to journal files to users not in systemd-journal Also, don't apply access mode recursively to /var/log/journal/*/, since that might be quite large, and should be correct anyway.
2014-06-11 12:23:16 +04:00
Z /run/log/journal/%m ~2750 root systemd-journal - -
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 14:35:51 +03:00
{% if HAVE_ACL %}
{% if ENABLE_ADM_GROUP and ENABLE_WHEEL_GROUP %}
tmpfiles: apply ACLs to top-level journal directory in /run, too We already apply them to the directory in /var. Let's do the same in /run too. That's because due to the log namespace logic we nowadays can gain additional subdirs there during regular operation.
2019-11-27 21:15:11 +03:00
a+ /run/log/journal - - - - d:group::r-x,d:group:adm:r-x,d:group:wheel:r-x,group::r-x,group:adm:r-x,group:wheel:r-x
tmpfiles.d/systemd: use ACL 'X' bit where appropriate
2024-03-05 12:16:49 +03:00
A+ /run/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x,group:adm:r-X,group:wheel:r-X
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 14:35:51 +03:00
{% elif ENABLE_ADM_GROUP %}
tmpfiles: apply ACLs to top-level journal directory in /run, too We already apply them to the directory in /var. Let's do the same in /run too. That's because due to the log namespace logic we nowadays can gain additional subdirs there during regular operation.
2019-11-27 21:15:11 +03:00
a+ /run/log/journal - - - - d:group::r-x,d:group:adm:r-x,group::r-x,group:adm:r-x
tmpfiles.d/systemd: use ACL 'X' bit where appropriate
2024-03-05 12:16:49 +03:00
A+ /run/log/journal/%m - - - - d:group:adm:r-x,group:adm:r-X
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 14:35:51 +03:00
{% elif ENABLE_WHEEL_GROUP %}
tmpfiles: apply ACLs to top-level journal directory in /run, too We already apply them to the directory in /var. Let's do the same in /run too. That's because due to the log namespace logic we nowadays can gain additional subdirs there during regular operation.
2019-11-27 21:15:11 +03:00
a+ /run/log/journal - - - - d:group::r-x,d:group:wheel:r-x,group::r-x,group:wheel:r-x
tmpfiles.d/systemd: use ACL 'X' bit where appropriate
2024-03-05 12:16:49 +03:00
A+ /run/log/journal/%m - - - - d:group:wheel:r-x,group:wheel:r-X
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 14:35:51 +03:00
{% endif %}
{% endif %}
tmpfiles: don't allow read access to journal files to users not in systemd-journal Also, don't apply access mode recursively to /var/log/journal/*/, since that might be quite large, and should be correct anyway.
2014-06-11 12:23:16 +04:00
z /var/log/journal 2755 root systemd-journal - -
z /var/log/journal/%m 2755 root systemd-journal - -
tmpfiles: set acls on system.journal explicitly https://github.com/systemd/systemd/issues/1397
2015-11-30 02:48:40 +03:00
z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 14:35:51 +03:00
{% if HAVE_ACL %}
{% if ENABLE_ADM_GROUP and ENABLE_WHEEL_GROUP %}
tmpfiles: merge lines for the same inodes
2019-11-27 21:13:34 +03:00
a+ /var/log/journal - - - - d:group::r-x,d:group:adm:r-x,d:group:wheel:r-x,group::r-x,group:adm:r-x,group:wheel:r-x
a+ /var/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x,group:adm:r-x,group:wheel:r-x
tmpfiles: set acls on system.journal explicitly https://github.com/systemd/systemd/issues/1397
2015-11-30 02:48:40 +03:00
a+ /var/log/journal/%m/system.journal - - - - group:adm:r--,group:wheel:r--
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 14:35:51 +03:00
{% elif ENABLE_ADM_GROUP %}
tmpfiles: merge lines for the same inodes
2019-11-27 21:13:34 +03:00
a+ /var/log/journal - - - - d:group::r-x,d:group:adm:r-x,group::r-x,group:adm:r-x
a+ /var/log/journal/%m - - - - d:group:adm:r-x,group:adm:r-x
build-sys: allow references to wheel group to be omitted https://github.com/systemd/systemd/issues/2492
2016-02-15 19:08:26 +03:00
a+ /var/log/journal/%m/system.journal - - - - group:adm:r--
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 14:35:51 +03:00
{% elif ENABLE_WHEEL_GROUP %}
tmpfiles: merge lines for the same inodes
2019-11-27 21:13:34 +03:00
a+ /var/log/journal - - - - d:group::r-x,d:group:wheel:r-x,group::r-x,group:wheel:r-x
a+ /var/log/journal/%m - - - - d:group:wheel:r-x,group:wheel:r-x
build-sys: allow references to adm group to be omitted (#3150)
2016-05-01 07:02:17 +03:00
a+ /var/log/journal/%m/system.journal - - - - group:wheel:r--
meson: use jinja2 for tmpfiles.d templates HAVE_SMACK_RUN_LABEL was dropped back in 348b44372f36010d48d9a7dda14ef67155753a71, so one line in etc.conf was not rendered as expected ;( Checking if names are defined is paying for itself!
2021-05-16 14:35:51 +03:00
{% endif %}
{% endif %}
tmpfiles: automatically clean up /var/lib/systemd/coredump after 3d
2014-06-19 00:06:25 +04:00
d /var/lib/systemd 0755 root root -
coredump: keep core files for two weeks We have two mechanisms that remove old coredumps: systemd-coredump has parameters based on disk use / remaining disk free, and systemd-tmpfiles does cleanup based on time. The first mechanism should prevent us from using too much disk space in case something is crashing continuously or there are very large core files. The limit of 3 days makes it likely that the core file will be gone by the time the admin looks at the issue. E.g. if something crashes on Friday, the coredump would likely be gone before people are back on Monday to look at it.
2023-12-05 17:56:54 +03:00
d /var/lib/systemd/coredump 0755 root root 2w
core: Add RootEphemeral= setting This setting allows services to run in an ephemeral copy of the root directory or root image. To make sure the ephemeral copies are always cleaned up, we add a tmpfiles snippet to unconditionally clean up /var/lib/systemd/ephemeral. To prevent in use ephemeral copies from being cleaned up by tmpfiles, we use the newly added COPY_LOCK_BSD and BTRFS_SNAPSHOT_LOCK_BSD flags to take a BSD lock on the ephemeral copies which instruct tmpfiles to not touch those ephemeral copies as long as the BSD lock is held.
2023-06-06 18:44:09 +03:00
# Files and directories in /var/lib/systemd/ephemeral-trees are locked by pid 1 to prevent tmpfiles from
# removing them, and tmpfiles is told to clean up anything in /var/lib/systemd/ephemeral-trees that isn't
# locked unconditionally.
d /var/lib/systemd/ephemeral-trees 0755 root root 0
tmpfiles: create /var/{lib,log,cache}/private during early boot This directory is used by the DynamicUer= stuff when used in combination with StateDirectory=/LogDirectory=/CacheDirectory=. Let's make sure the dir exists early on with the right perms. This is not strictly necessary as we'll also create the dir on demand if it is missing, but in the interest of grabbing the name early on, and making things more explicit let's also list this in a tmpfiles.d/ snippet.
2018-05-17 20:52:37 +03:00
d /var/lib/private 0700 root root -
d /var/log/private 0700 root root -
d /var/cache/private 0700 root root -
tmpfiles: copy PCR sig/pkey from initrd /.extra/ into /run/ Now that sd-stub will place the PCR signature and its public key in the initrd's /.extra/ directory, let's copy it from there into /run/ from userspace. This is done because /.extra/ is on the initrd's tmpfs which will be emptied during the initrd → host transition. Since we want these two files to survive we'll copy them – if they exist – into /run/ where they will survive the transition. Thus, with this last change the files will have safely propagated from their PE sections into files in /run/ where userspace can find them The paths in /run/ happen to be the exact ones that systemd-cryptenroll/systemd-cryptsetup/systemd-creds look for them.
2022-08-25 18:16:52 +03:00
{% if ENABLE_EFI %}
Remove duplicated word
2022-10-29 08:02:37 +03:00
# Copy sd-stub provided PCR signature and public key file from initrd into /run/, so that it will survive the initrd stage
tmpfiles: copy PCR sig/pkey from initrd /.extra/ into /run/ Now that sd-stub will place the PCR signature and its public key in the initrd's /.extra/ directory, let's copy it from there into /run/ from userspace. This is done because /.extra/ is on the initrd's tmpfs which will be emptied during the initrd → host transition. Since we want these two files to survive we'll copy them – if they exist – into /run/ where they will survive the transition. Thus, with this last change the files will have safely propagated from their PE sections into files in /run/ where userspace can find them The paths in /run/ happen to be the exact ones that systemd-cryptenroll/systemd-cryptsetup/systemd-creds look for them.
2022-08-25 18:16:52 +03:00
C /run/systemd/tpm2-pcr-signature.json 0444 root root - /.extra/tpm2-pcr-signature.json
C /run/systemd/tpm2-pcr-public-key.pem 0444 root root - /.extra/tpm2-pcr-public-key.pem
{% endif %}
Copy Permalink