shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-02-02 13:47:27 +03:00
Code
systemd/units/systemd-resolved.service.in

46 lines
1.5 KiB
SYSTEMD
Raw Normal View History

networkd: add missing files
2014-05-16 20:14:23 +02:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
resolved: add daemon to manage resolv.conf Also remove the equivalent functionality from networkd.
2014-05-18 22:10:48 +02:00
[Unit]
Description=Network Name Resolution
Documentation=man:systemd-resolved.service(8)
units: use https for the freedesktop url (#6227)
2017-06-29 04:54:12 +02:00
Documentation=https://www.freedesktop.org/wiki/Software/systemd/resolved
Documentation=https://www.freedesktop.org/wiki/Software/systemd/writing-network-configuration-managers
Documentation=https://www.freedesktop.org/wiki/Software/systemd/writing-resolver-clients
units: fix typo in systemd-resolved.service There's no network.service unit, we actually mean network.target here. Reported by Fco. Eduardo Ramírez.
2015-05-14 22:32:35 +02:00
After=systemd-networkd.service network.target
units: systemd-resolved should start before network-online.target and nss-lookup.target (#5691) systemd-resolved provides 1. local API via NSS and D-Bus 2. kind of a local "DNS proxy" through its stub listener The 1st item should be started before nss-lookup.target. The 2nd item should be started before network-online.target, because if the networking works in general, then DNS (and DNS proxy) should too. Fixes #5650
2017-04-21 18:21:17 +09:00
Before=network-online.target nss-lookup.target
Wants=nss-lookup.target
resolved: add daemon to manage resolv.conf Also remove the equivalent functionality from networkd.
2014-05-18 22:10:48 +02:00
[Service]
Type=notify
Restart=always
RestartSec=0
units: make use of the new !! ExecStart= prefix in systemd-resolved.service Let's make use of !! to run resolved with ambient capabilities on systems supporting them.
2017-08-09 16:15:07 +02:00
ExecStart=!!@rootlibexecdir@/systemd-resolved
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 13:23:27 +02:00
WatchdogSec=3min
units: make use of the new !! ExecStart= prefix in systemd-resolved.service Let's make use of !! to run resolved with ambient capabilities on systems supporting them.
2017-08-09 16:15:07 +02:00
User=systemd-resolve
CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 13:23:27 +02:00
PrivateTmp=yes
PrivateDevices=yes
units: switch on ProtectSystem=strict for our long running services Let's step up the protection a notch
2017-02-09 10:58:28 +01:00
ProtectSystem=strict
core: rename ReadOnlySystem= to ProtectSystem= and add a third value for also mounting /etc read-only Also, rename ProtectedHome= to ProtectHome=, to simplify things a bit. With this in place we now have two neat options ProtectSystem= and ProtectHome= for protecting the OS itself (and optionally its configuration), and for protecting the user's data.
2014-06-04 18:07:55 +02:00
ProtectHome=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 13:23:27 +02:00
ProtectControlGroups=yes
ProtectKernelTunables=yes
units: turn on ProtectKernelModules= for most long-running services
2017-02-09 11:09:50 +01:00
ProtectKernelModules=yes
units: enable MemoryDenyWriteExecute (#3459) Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute. Closes: #3459
2016-06-08 12:23:37 +00:00
MemoryDenyWriteExecute=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 13:23:27 +02:00
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
units: make use of @reboot and @swap in our long-running service SystemCallFilter= settings Tighten security up a bit more.
2017-02-09 11:22:08 +01:00
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
units: set SystemCallArchitectures=native on all our long-running services
2017-02-08 22:32:37 +01:00
SystemCallArchitectures=native
units: set LockPersonality= for all our long-running services (#6819) Let's lock things down. Also, using it is the only way how to properly test this to the fullest extent.
2017-09-14 19:45:40 +02:00
LockPersonality=yes
units: make use of the new !! ExecStart= prefix in systemd-resolved.service Let's make use of !! to run resolved with ambient capabilities on systems supporting them.
2017-08-09 16:15:07 +02:00
RuntimeDirectory=systemd/resolve
RuntimeDirectoryPreserve=yes
resolved: add daemon to manage resolv.conf Also remove the equivalent functionality from networkd.
2014-05-18 22:10:48 +02:00
[Install]
WantedBy=multi-user.target
units: enable resolved bus activation though a symlink in /etc The change: -/usr/lib/systemd/system/dbus-org.freedesktop.resolve1.service +/etc/systemd/system/dbus-org.freedesktop.resolve1.service If resolved is disabled, without this, talking to the resolved bus API will activate it regardless whether it is enabled or not, let's fix that.
2017-02-16 17:48:48 +01:00
Alias=dbus-org.freedesktop.resolve1.service
Copy Permalink