shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-01 17:51:22 +03:00
Code
dd4c15296c
systemd/units/systemd-homed.service.in

43 lines
1.3 KiB
SYSTEMD
Raw Normal View History

license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 07:23:58 +03:00
# SPDX-License-Identifier: LGPL-2.1-or-later
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
#
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
homed: replace "home directory" with "home area" in a few places
2020-03-11 15:07:10 +03:00
Description=Home Area Manager
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
Documentation=man:systemd-homed.service(8)
man,units: link to the new dbus-api man pages
2020-09-29 09:03:10 +03:00
Documentation=man:org.freedesktop.home1(5)
units: do not pull in home.mount from systemd-homed.service /home is posibly a remote file system. it makes sense to order homed after it, so that we can properly enumerate users in it, but we probably shouldn't pull it in ourselves, and leave that to users to configure otherwise. Fixes: #15102
2020-03-31 12:35:08 +03:00
After=home.mount
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
[Service]
BusName=org.freedesktop.home1
homed: add missing capabilities for SMB/CIFS backend In 2020 mount.cifs started to require a bunch for caps to work. let's add them to the capability bounding set. Also, SMB support obviously needs network access, hence open that up. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1962920
2021-08-31 11:04:06 +03:00
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_SETGID CAP_SETUID CAP_SYS_RESOURCE CAP_SETPCAP CAP_DAC_READ_SEARCH
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
DeviceAllow=/dev/loop-control rw
DeviceAllow=/dev/mapper/control rw
DeviceAllow=block-* rw
homed: allow systemd-homed access to FIDO2 devices Add DeviceAllow= option for FIDO2 devices in systemd-homed.service.
2021-07-12 20:57:43 +03:00
DeviceAllow=char-hidraw rw
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
ExecStart={{ROOTLIBEXECDIR}}/systemd-homed
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
KillMode=mixed
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
LimitNOFILE={{HIGH_RLIMIT_NOFILE}}
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
homed: add missing capabilities for SMB/CIFS backend In 2020 mount.cifs started to require a bunch for caps to work. let's add them to the capability bounding set. Also, SMB support obviously needs network access, hence open that up. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1962920
2021-08-31 11:04:06 +03:00
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_ALG AF_INET AF_INET6
home: add new systemd-homed service that can manage LUKS homes Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2019-07-04 19:35:39 +03:00
RestrictNamespaces=mnt
RestrictRealtime=yes
StateDirectory=systemd/home
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service @mount
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
{{SERVICE_WATCHDOG}}
units: make systemd-homed.service installable Fixes #15083. Users might want to disable homed if not used to save resources.
2020-03-13 20:38:09 +03:00
[Install]
WantedBy=multi-user.target
Alias=dbus-org.freedesktop.home1.service
homed: explicitly deactivate all home directories on shutdown Let's explicitly deactivate all home dirs on shutdown, in order to properly synchronizing unmounting and avoiding blocking devices. Previously, we'd rely on automatic deactivation when home directories become unused. However, that scheme is asynchronous, and ongoing deactviations might conflicts with attempts to unmount /home. Let's fix that by providing an explicit service systemd-homed-activate.service whose only job is to have a ExecStop= line that explicitly deactivates all home directories on shutdown. This service can the be ordered after home.mount and similar, ensuring that we'll first deactivate all homes before deactivating /home itself during shutdown. This is kept separate from systemd-homed.service so that it is possible to restart systemd-homed.service without deactivating all home directories. Fixes: #16842
2020-09-21 19:25:46 +03:00
Also=systemd-homed-activate.service systemd-userdbd.service
Copy Permalink