shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-05 06:52:22 +03:00
Code
c8a79aa812
systemd/units/systemd-journald.service.in

42 lines
1.4 KiB
SYSTEMD
Raw Normal View History

Add SPDX license headers to unit files
2017-11-18 19:35:03 +03:00
# SPDX-License-Identifier: LGPL-2.1+
#
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 02:20:58 +04:00
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
# (at your option) any later version.
[Unit]
Description=Journal Service
units: fix man section
2012-06-01 19:26:28 +04:00
Documentation=man:systemd-journald.service(8) man:journald.conf(5)
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
DefaultDependencies=no
Requires=systemd-journald.socket
journald: if available pull audit messages from the kernel into journal logs
2014-11-03 22:58:24 +03:00
After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket syslog.socket
unit: make sure structured logging is available before we enter the main boot phase
2012-08-25 01:18:35 +04:00
Before=sysinit.target
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
[Service]
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
ExecStart=@rootlibexecdir@/systemd-journald
journald: make sure we retain all stream fds across restarts (#6348) Currently we set 4096 as maximum for number of stream connections that we accept. However maximum number of file descriptors that systemd is willing to accept from us is just 1024. This means we can't retain all stream connections that we accepted. Hence bump the limit of fds in a unit file so that systemd holds open all stream fds while we are restarted. New limit is set to 4224 (4096 + 128).
2017-07-17 11:04:37 +03:00
FileDescriptorStoreMax=4224
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
IPAddressDeny=any
LockPersonality=yes
units: enable MemoryDenyWriteExecute (#3459) Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute. Closes: #3459
2016-06-08 15:23:37 +03:00
MemoryDenyWriteExecute=yes
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
NoNewPrivileges=yes
Restart=always
RestartSec=0
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
RestrictAddressFamilies=AF_UNIX AF_NETLINK
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
RestrictNamespaces=yes
RestrictRealtime=yes
Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket
StandardOutput=null
units: set SystemCallArchitectures=native on all our long-running services
2017-02-09 00:32:37 +03:00
SystemCallArchitectures=native
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 19:19:48 +03:00
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
Type=notify
WatchdogSec=3min
journal: add unit files and shared library glue
2011-12-30 20:50:37 +04:00
units: bump the RLIMIT_NOFILE soft limit for all services that access the journal This updates the unit files of all our serviecs that deal with journal stuff to use a higher RLIMIT_NOFILE soft limit by default. The new value is the same as used for the new HIGH_RLIMIT_NOFILE we just added. With this we ensure all code that access the journal has higher RLIMIT_NOFILE. The code that runs as daemon via the unit files, the code that is run from the user's command line via C code internal to the relevant tools. In some cases this means we'll redundantly bump the limits as there are tools run both from the command line and as service.
2018-10-01 19:08:27 +03:00
# If there are many split up journal files we need a lot of fds to access them
# all in parallel.
meson: define @HIGH_RLIMIT_NOFILE@ and use it everywhere
2018-10-17 11:21:48 +03:00
LimitNOFILE=@HIGH_RLIMIT_NOFILE@
Copy Permalink