systemd/units/systemd-journal-remote.service.in

#  SPDX-License-Identifier: LGPL-2.1+
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Journal Remote Sink Service
Documentation=man:systemd-journal-remote(8) man:journal-remote.conf(5)
Requires=systemd-journal-remote.socket

[Service]
ExecStart=@rootlibexecdir@/systemd-journal-remote --listen-https=-3 --output=/var/log/journal/remote/
User=systemd-journal-remote
WatchdogSec=3min
PrivateTmp=yes
PrivateDevices=yes
PrivateNetwork=yes
ProtectSystem=strict
ProtectHome=yes
ProtectControlGroups=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictNamespaces=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
LockPersonality=yes
LogsDirectory=journal/remote

[Install]
Also=systemd-journal-remote.socket
Add SPDX license headers to unit files 2017-11-18 19:35:03 +03:00			`# SPDX-License-Identifier: LGPL-2.1+`
			`#`
journal-remote: add units and read certs from default locations 2014-03-31 07:08:02 +04:00			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
			`Description=Journal Remote Sink Service`
journal-remote: add documents in the unit files 2015-12-15 04:51:12 +03:00			`Documentation=man:systemd-journal-remote(8) man:journal-remote.conf(5)`
journal-remote: add units and read certs from default locations 2014-03-31 07:08:02 +04:00			`Requires=systemd-journal-remote.socket`

			`[Service]`
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS. 2016-08-26 14:23:27 +03:00			`ExecStart=@rootlibexecdir@/systemd-journal-remote --listen-https=-3 --output=/var/log/journal/remote/`
journal-remote: add units and read certs from default locations 2014-03-31 07:08:02 +04:00			`User=systemd-journal-remote`
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS. 2016-08-26 14:23:27 +03:00			`WatchdogSec=3min`
journal-remote: add units and read certs from default locations 2014-03-31 07:08:02 +04:00			`PrivateTmp=yes`
			`PrivateDevices=yes`
			`PrivateNetwork=yes`
units: switch on ProtectSystem=strict for our long running services Let's step up the protection a notch 2017-02-09 12:58:28 +03:00			`ProtectSystem=strict`
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS. 2016-08-26 14:23:27 +03:00			`ProtectHome=yes`
			`ProtectControlGroups=yes`
			`ProtectKernelTunables=yes`
units: turn on ProtectKernelModules= for most long-running services 2017-02-09 13:09:50 +03:00			`ProtectKernelModules=yes`
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS. 2016-08-26 14:23:27 +03:00			`MemoryDenyWriteExecute=yes`
			`RestrictRealtime=yes`
units: restrict namespace for a good number of our own services Basically, we turn it on for most long-running services, with the exception of machined (whose child processes need to join containers here and there), and importd (which sandboxes tar in a CLONE_NEWNET namespace). machined is left unrestricted, and importd is restricted to use only "net" 2017-02-09 12:28:23 +03:00			`RestrictNamespaces=yes`
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS. 2016-08-26 14:23:27 +03:00			`RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6`
units: set SystemCallArchitectures=native on all our long-running services 2017-02-09 00:32:37 +03:00			`SystemCallArchitectures=native`
units: set LockPersonality= for all our long-running services (#6819) Let's lock things down. Also, using it is the only way how to properly test this to the fullest extent. 2017-09-14 20:45:40 +03:00			`LockPersonality=yes`
units: use {State,Logs}Directory= if they are applicable 2017-08-02 11:35:11 +03:00			`LogsDirectory=journal/remote`
journal-remote: add units and read certs from default locations 2014-03-31 07:08:02 +04:00
			`[Install]`
			`Also=systemd-journal-remote.socket`