picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Systemd/units/systemd-logind.service.in

66 lines
1.9 KiB
SYSTEMD
Raw Normal View History

license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 05:23:58 +01:00
# SPDX-License-Identifier: LGPL-2.1-or-later
Add SPDX license headers to unit files
2017-11-18 17:35:03 +01:00
#
dbus: add dbus introspection extraction
2011-06-17 00:15:02 +02:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 00:20:58 +02:00
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
dbus: add dbus introspection extraction
2011-06-17 00:15:02 +02:00
# (at your option) any later version.
[Unit]
units: change description of systemd-logind.service "Login Service" doesn''t explain much, esp. considering that logind is actually is for logins. I think "User Login Management" is better, but not that great either. Suggestions welcome.
2020-04-23 09:59:03 +02:00
Description=User Login Management
tree-wide: update web link to logind description https://www.freedesktop.org/wiki/Software/systemd/multiseat/ says that it is obsoleted by sd-login(3), so it doesn't make much sense to link to the former.
2020-10-15 20:49:18 +02:00
Documentation=man:sd-login(3)
man,units: link to the new dbus-api man pages
2020-09-29 08:03:10 +02:00
Documentation=man:systemd-logind.service(8)
Documentation=man:logind.conf(5)
Documentation=man:org.freedesktop.login1(5)
units: Split modprobing out into a separate service unit Devices referred to by `DeviceAllow=` sandboxing are resolved into their corresponding major numbers when the unit is loaded by looking at `/proc/devices`. If a reference is made to a device which is not yet available, the `DeviceAllow` is ignored and the unit's processes cannot access that device. In both logind and nspawn, we have `DeviceAllow=` lines, and `modprobe` in `ExecStartPre=` to load some kernel modules. Those kernel modules cause device nodes to become available when they are loaded: the device nodes may not exist when the unit itself is loaded. This means that the unit's processes will not be able to access the device since the `DeviceAllow=` will have been resolved earlier and denied it. One way to fix this would be to re-evaluate the available devices and re-apply the policy to the cgroup, but this cannot work atomically on cgroupsv1. So we fall back to a second approach: instead of running `modprobe` via `ExecStartPre`, we move this out to a separate unit and order it before the units which want the module. Closes #14322. Fixes: #13943.
2020-01-07 15:33:29 +01:00
Wants=user.slice modprobe@drm.service
After=nss-user-lookup.target user.slice modprobe@drm.service
dbus: add dbus introspection extraction
2011-06-17 00:15:02 +02:00
Drop kdbus bits Some kdbus_flag and memfd related parts are left behind, because they are entangled with the "legacy" dbus support. test-bus-benchmark is switched to "manual". It was already broken before (in the non-kdbus mode) but apparently nobody noticed. Hopefully it can be fixed later.
2017-07-23 17:45:57 +02:00
# Ask for the dbus socket.
units: systemd-logind fails hard without dbus That is, without --enable-kdbus and kdbus running. With --enable-kdbus things are more complicated, because dbus might be necessary, if kdbus is missing at runtime. If it is not necessary, the socket will be started, which is not imporant, but not the service.
2014-02-14 23:01:43 +01:00
Wants=dbus.socket
After=dbus.socket
dbus: add dbus introspection extraction
2011-06-17 00:15:02 +02:00
[Service]
BusName=org.freedesktop.login1
Revert "Revert "units: lock down logind with fs namespacing options"" This reverts commit 28f38a76345b7548700d2337dd8b9a8c3f5b0643. The revert was done because Ubuntu CI was completely broken with it. Let's see if it fares better now.
2018-12-18 15:05:48 +01:00
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG CAP_LINUX_IMMUTABLE
unit: make logind can access ESP Fixes the following error: ``` logind[601]: Failed to open file system "/dev/block/259:1": Operation not permitted ```
2019-08-02 22:05:43 +02:00
DeviceAllow=block-* r
units: deny access to block devices While the need for access to character devices can be tricky to determine for the general case, it's obvious that most of our services have no need to access block devices. For logind and timedated this can be tightened further.
2019-05-01 14:28:36 +02:00
DeviceAllow=char-/dev/console rw
DeviceAllow=char-drm rw
DeviceAllow=char-input rw
DeviceAllow=char-tty rw
DeviceAllow=char-vcs rw
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 17:19:48 +01:00
ExecStart=@rootlibexecdir@/systemd-logind
FileDescriptorStoreMax=512
IPAddressDeny=any
LockPersonality=yes
units: enable MemoryDenyWriteExecute (#3459) Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute. Closes: #3459
2016-06-08 14:23:37 +02:00
MemoryDenyWriteExecute=yes
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 17:19:48 +01:00
NoNewPrivileges=yes
Revert "Revert "units: lock down logind with fs namespacing options"" This reverts commit 28f38a76345b7548700d2337dd8b9a8c3f5b0643. The revert was done because Ubuntu CI was completely broken with it. Let's see if it fares better now.
2018-12-18 15:05:48 +01:00
PrivateTmp=yes
units: turn on ProtectProc= wherever suitable
2020-08-06 14:50:38 +02:00
ProtectProc=invisible
units: add ProtectClock=yes Add `ProtectClock=yes` to systemd units. Since it implies certain `DeviceAllow=` rules, make sure that the units have `DeviceAllow=` rules so they are still able to access other devices. Exclude timesyncd and timedated.
2020-04-02 20:18:11 +02:00
ProtectClock=yes
Revert "Revert "units: lock down logind with fs namespacing options"" This reverts commit 28f38a76345b7548700d2337dd8b9a8c3f5b0643. The revert was done because Ubuntu CI was completely broken with it. Let's see if it fares better now.
2018-12-18 15:05:48 +01:00
ProtectControlGroups=yes
ProtectHome=yes
units: enable ProtectHostname=yes
2019-02-18 23:30:12 +01:00
ProtectHostname=yes
units: set ProtectKernelLogs=yes on relevant units We set ProtectKernelLogs=yes on all long running services except for udevd, since it accesses /dev/kmsg, and journald, since it calls syslog and accesses /dev/kmsg.
2019-11-14 01:56:23 +01:00
ProtectKernelLogs=yes
units: turn on ProtectProc= wherever suitable
2020-08-06 14:50:38 +02:00
ProtectKernelModules=yes
Revert "Revert "units: lock down logind with fs namespacing options"" This reverts commit 28f38a76345b7548700d2337dd8b9a8c3f5b0643. The revert was done because Ubuntu CI was completely broken with it. Let's see if it fares better now.
2018-12-18 15:05:48 +01:00
ProtectSystem=strict
ReadWritePaths=/etc /run
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 17:19:48 +01:00
Restart=always
RestartSec=0
unit: tighten sandboxing for logind
2018-04-27 11:11:29 +02:00
RestrictAddressFamilies=AF_UNIX AF_NETLINK
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 17:19:48 +01:00
RestrictNamespaces=yes
RestrictRealtime=yes
units: turn on RestrictSUIDSGID= in most of our long-running daemons
2019-03-20 19:52:20 +01:00
RestrictSUIDSGID=yes
Revert "Revert "units: lock down logind with fs namespacing options"" This reverts commit 28f38a76345b7548700d2337dd8b9a8c3f5b0643. The revert was done because Ubuntu CI was completely broken with it. Let's see if it fares better now.
2018-12-18 15:05:48 +01:00
RuntimeDirectory=systemd/sessions systemd/seats systemd/users systemd/inhibit systemd/shutdown
RuntimeDirectoryPreserve=yes
logind: make sure the service gets access to the linger directory Fixes: #12401
2019-04-28 11:17:59 +02:00
StateDirectory=systemd/linger
units: set SystemCallArchitectures=native on all our long-running services
2017-02-08 22:32:37 +01:00
SystemCallArchitectures=native
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 17:19:48 +01:00
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
meson: allow WatchdogSec= in services to be configured As discussed on systemd-devel [1], in Fedora we get lots of abrt reports about the watchdog firing [2], but 100% of them seem to be caused by resource starvation in the machine, and never actual deadlocks in the services being monitored. Killing the services not only does not improve anything, but it makes the resource starvation worse, because the service needs cycles to restart, and coredump processing is also fairly expensive. This adds a configuration option to allow the value to be changed. If the setting is not set, there is no change. My plan is to set it to some ridiculusly high value, maybe 1h, to catch cases where a service is actually hanging. [1] https://lists.freedesktop.org/archives/systemd-devel/2019-October/043618.html [2] https://bugzilla.redhat.com/show_bug.cgi?id=1300212
2019-10-25 12:17:24 +02:00
@SERVICE_WATCHDOG@
units: increase LimitNOFILE a bit since we need one fd per session (for logind) and one fd per service (for stdout-syslog-bridge) increase the default rlimit a bit.
2011-10-11 04:43:29 +02:00
units: bump the RLIMIT_NOFILE soft limit for all services that access the journal This updates the unit files of all our serviecs that deal with journal stuff to use a higher RLIMIT_NOFILE soft limit by default. The new value is the same as used for the new HIGH_RLIMIT_NOFILE we just added. With this we ensure all code that access the journal has higher RLIMIT_NOFILE. The code that runs as daemon via the unit files, the code that is run from the user's command line via C code internal to the relevant tools. In some cases this means we'll redundantly bump the limits as there are tools run both from the command line and as service.
2018-10-01 18:08:27 +02:00
# Increase the default a bit in order to allow many simultaneous logins since
# we keep one fd open per session.
meson: define @HIGH_RLIMIT_NOFILE@ and use it everywhere
2018-10-17 10:21:48 +02:00
LimitNOFILE=@HIGH_RLIMIT_NOFILE@