shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-05 06:52:22 +03:00
Code
ccefd046c6
systemd/units/systemd-journal-upload.service.in

39 lines
1.1 KiB
SYSTEMD
Raw Normal View History

journal-remote: add units and read certs from default locations
2014-03-31 07:08:02 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
Description=Journal Remote Upload Service
journal-remote: add documents in the unit files
2015-12-15 04:51:12 +03:00
Documentation=man:systemd-journal-upload(8)
units: journal-upload Wants= and After=network-online.target (#4354) To upload journal entries to a remote server, it is required that the network is online.
2016-10-12 12:13:13 +03:00
Wants=network-online.target
After=network-online.target
journal-remote: add units and read certs from default locations
2014-03-31 07:08:02 +04:00
[Service]
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state
journal-remote: add units and read certs from default locations
2014-03-31 07:08:02 +04:00
User=systemd-journal-upload
journal-remote: add SupplementaryGroups to systemd-journal-upload.service
2016-01-15 09:25:36 +03:00
SupplementaryGroups=systemd-journal
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
WatchdogSec=3min
journal-remote: add units and read certs from default locations
2014-03-31 07:08:02 +04:00
PrivateTmp=yes
PrivateDevices=yes
units: switch on ProtectSystem=strict for our long running services Let's step up the protection a notch
2017-02-09 12:58:28 +03:00
ProtectSystem=strict
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
ProtectHome=yes
ProtectControlGroups=yes
ProtectKernelTunables=yes
units: turn on ProtectKernelModules= for most long-running services
2017-02-09 13:09:50 +03:00
ProtectKernelModules=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
units: restrict namespace for a good number of our own services Basically, we turn it on for most long-running services, with the exception of machined (whose child processes need to join containers here and there), and importd (which sandboxes tar in a CLONE_NEWNET namespace). machined is left unrestricted, and importd is restricted to use only "net"
2017-02-09 12:28:23 +03:00
RestrictNamespaces=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 14:23:27 +03:00
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
units: set SystemCallArchitectures=native on all our long-running services
2017-02-09 00:32:37 +03:00
SystemCallArchitectures=native
journal-upload: add state file directory to ReadWritePaths (#5578) The commit c7fb922d6250543ba5462fa7a6ff03cc8f628e94 prohibits journal-upload to save its state in /var/lib/systemd/journal-upload/state, thus the daemon fails and outputs the following error message even if the directory is not read-only file system ```Cannot save state to /var/lib/systemd/journal-upload/state: Read-only file system``` This commit adds the permission the daemon to write the state file.
2017-03-30 19:01:03 +03:00
ReadWritePaths=/var/lib/systemd/journal-upload
journal-remote: add units and read certs from default locations
2014-03-31 07:08:02 +04:00
journal: bump RLIMIT_NOFILE when journal files to 16K (if possible) When there are a lot of split out journal files, we might run out of fds quicker then we want. Hence: bump RLIMIT_NOFILE to 16K if possible. Do these even for journalctl. On Fedora the soft RLIMIT_NOFILE is at 1K, the hard at 4K by default for normal user processes, this code hence bumps this up for users to 4K. https://bugzilla.redhat.com/show_bug.cgi?id=1179980
2015-01-08 05:17:50 +03:00
# If there are many split up journal files we need a lot of fds to
# access them all and combine
LimitNOFILE=16384
journal-remote: add units and read certs from default locations
2014-03-31 07:08:02 +04:00
[Install]
WantedBy=multi-user.target
Copy Permalink