5 Commits

Author	SHA1	Message	Date
Lennart Poettering	1b8689f949	core: rename ReadOnlySystem= to ProtectSystem= and add a third value for also mounting /etc read-only ... Also, rename ProtectedHome= to ProtectHome=, to simplify things a bit. With this in place we now have two neat options ProtectSystem= and ProtectHome= for protecting the OS itself (and optionally its configuration), and for protecting the user's data.	2014-06-04 18:12:55 +02:00
Lennart Poettering	417116f234	core: add new ReadOnlySystem= and ProtectedHome= settings for service units ... ReadOnlySystem= uses fs namespaces to mount /usr and /boot read-only for a service. ProtectedHome= uses fs namespaces to mount /home and /run/user inaccessible or read-only for a service. This patch also enables these settings for all our long-running services. Together they should be good building block for a minimal service sandbox, removing the ability for services to modify the operating system or access the user's private data.	2014-06-03 23:57:51 +02:00
Lennart Poettering	f21a71a907	core: enable PrivateNetwork= for a number of our long running services where this is useful	2014-03-19 23:25:28 +01:00
Lennart Poettering	37495eede9	journal: make gatewayd run under its own user ID	2013-03-05 19:15:31 +01:00
Lennart Poettering	7b17a7d72f	journal: add minimal journal gateway daemon based on GNU libmicrohttpd ... This minimal HTTP server can serve journal data via HTTP. Its primary purpose is synchronization of journal data across the network. It serves journal data in three formats: text/plain: the text format known from /var/log/messages application/json: the journal entries formatted as JSON application/vnd.fdo.journal: the binary export format of the journal The HTTP server also serves a small HTML5 app that makes use of the JSON serialization to present the journal data to the user. Examples: This downloads the journal in text format: # systemctl start systemd-journal-gatewayd.service # wget http://localhost:19531/entries Same for JSON: # curl -H"Accept: application/json" http://localhost:19531/entries Access via web browser: $ firefox http://localhost:19531/	2012-09-28 00:55:24 +02:00