picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
Systemd/units/systemd-timesyncd.service.in

50 lines
1.3 KiB
SYSTEMD
Raw Normal View History

Add SPDX license headers to unit files
2017-11-18 17:35:03 +01:00
# SPDX-License-Identifier: LGPL-2.1+
#
timesyncd: add unit and man page
2014-04-29 08:57:51 +02:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
Description=Network Time Synchronization
Documentation=man:systemd-timesyncd.service(8)
ConditionCapability=CAP_SYS_TIME
timesyncd: enable timesyncd in virtual machines On Fri, Mar 13, 2015 at 8:25 PM, Michael Marineau <michael.marineau@coreos.com> wrote: > Currently systemd-timesyncd.service includes > ConditionVirtualization=no, disabling it in both containers and > virtual machines. Each VM platform tends to deal with or ignore the > time problem in their own special ways, KVM/QEMU has the kernel time > source kvm-clock, Xen has had different schemes over the years, VMware > expects a userspace daemon sync the clock, and other platforms are > content to drift with the wind as far as I can tell. > > I don't know of a robust way to know if a platform needs a little > extra help from userspace to keep the clock sane or not but it seems > generally safer to try than to risk drifting. Does anyone know of a > reason to leave timesyncd off by default? Otherwise switching to > ConditionVirtualization=!container should be reasonable.
2015-03-15 19:44:59 +01:00
ConditionVirtualization=!container
units: minor cleanups
2014-06-17 02:18:33 +02:00
DefaultDependencies=no
unit: drop After=systemd-sysusers.service from timesyncd After=systemd-sysusers.service is not necessary, as timesyncd already enables DynamicUser=.
2018-05-19 18:09:57 +02:00
After=systemd-remount-fs.service
units: minor cleanups
2014-06-17 02:18:33 +02:00
Before=time-sync.target sysinit.target shutdown.target
timesyncd: save clock to disk everytime we get an NTP fix, and bump clock at boot using this This is useful to make sure the system clock stays monotonic even on systems that lack an RTC. Also, why we are at it, also use the systemd release time for bumping the clock, since it's a slightly less bad than starting with jan 1st, 1970. This also moves timesyncd into the early bootphase, in order to make sure this initial bump is guaranteed to have finished by the time we start real daemons which might write to the file systemd and thus shouldn't leave 1970's timestamps all over the place...
2014-05-20 17:04:11 +02:00
Conflicts=shutdown.target
units: pull in time-sync.target from systemd-timedated.service After all, that's what we document for time-sync.target in systemd.special(5), hence let's follow our own suggestion.
2014-06-06 16:20:33 +02:00
Wants=time-sync.target
timesyncd: add unit and man page
2014-04-29 08:57:51 +02:00
[Service]
Type=notify
Restart=always
RestartSec=0
units: make use of !! ExecStart= prefix in systemd-timesyncd.service Let's make use of !! to run timesyncd with ambient capabilities on systems supporting them.
2017-08-10 09:07:08 +02:00
ExecStart=!!@rootlibexecdir@/systemd-timesyncd
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 13:23:27 +02:00
WatchdogSec=3min
units: make use of !! ExecStart= prefix in systemd-timesyncd.service Let's make use of !! to run timesyncd with ambient capabilities on systems supporting them.
2017-08-10 09:07:08 +02:00
User=systemd-timesync
timesyncd: enable DynamicUser=
2017-10-06 09:05:20 +02:00
DynamicUser=yes
units: make use of !! ExecStart= prefix in systemd-timesyncd.service Let's make use of !! to run timesyncd with ambient capabilities on systems supporting them.
2017-08-10 09:07:08 +02:00
CapabilityBoundingSet=CAP_SYS_TIME
AmbientCapabilities=CAP_SYS_TIME
timesyncd: run timesyncd as unpriviliged user "systemd-timesync" (but still with CAP_SYS_TIME)
2014-05-17 20:33:47 +02:00
PrivateDevices=yes
core: rename ReadOnlySystem= to ProtectSystem= and add a third value for also mounting /etc read-only Also, rename ProtectedHome= to ProtectHome=, to simplify things a bit. With this in place we now have two neat options ProtectSystem= and ProtectHome= for protecting the OS itself (and optionally its configuration), and for protecting the user's data.
2014-06-04 18:07:55 +02:00
ProtectHome=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 13:23:27 +02:00
ProtectControlGroups=yes
ProtectKernelTunables=yes
units: turn on ProtectKernelModules= for most long-running services
2017-02-09 11:09:50 +01:00
ProtectKernelModules=yes
units: enable MemoryDenyWriteExecute (#3459) Secure daemons shipped by systemd by enabling MemoryDenyWriteExecute. Closes: #3459
2016-06-08 14:23:37 +02:00
MemoryDenyWriteExecute=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 13:23:27 +02:00
RestrictRealtime=yes
units: restrict namespace for a good number of our own services Basically, we turn it on for most long-running services, with the exception of machined (whose child processes need to join containers here and there), and importd (which sandboxes tar in a CLONE_NEWNET namespace). machined is left unrestricted, and importd is restricted to use only "net"
2017-02-09 10:28:23 +01:00
RestrictNamespaces=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 13:23:27 +02:00
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
time-wait-sync: use watchfile to coordinate with timesyncd Systems that have an accurate real-time clock may have an initial unsynchronized time that is close enough to the synchronized time that the final adjustment doesn't trigger a waking "clock set" event. Have timesyncd touch a file in its runtime directory as a secondary signal for synchronization. Continue to support the timerfd-based trigger as a sufficient condition when the watchfile is not present. Closes issue #8683
2018-04-09 20:39:16 +02:00
RuntimeDirectory=systemd/timesync
units: switch from system call blacklist to whitelist This is generally the safer approach, and is what container managers (including nspawn) do, hence let's move to this too for our own services. This is particularly useful as this this means the new @system-service system call filter group will get serious real-life testing quickly. This also switches from firing SIGSYS on unexpected syscalls to returning EPERM. This would have probably been a better default anyway, but it's hard to change that these days. When whitelisting system calls SIGSYS is highly problematic as system calls that are newly introduced to Linux become minefields for services otherwise. Note that this enables a system call filter for udev for the first time, and will block @clock, @mount and @swap from it. Some downstream distributions might want to revert this locally if they want to permit unsafe operations on udev rules, but in general this shiuld be mostly safe, as we already set MountFlags=shared for udevd, hence at least @mount won't change anything.
2018-04-19 11:04:17 +02:00
SystemCallFilter=@system-service @clock
SystemCallErrorNumber=EPERM
units: set SystemCallArchitectures=native on all our long-running services
2017-02-08 22:32:37 +01:00
SystemCallArchitectures=native
units: set LockPersonality= for all our long-running services (#6819) Let's lock things down. Also, using it is the only way how to properly test this to the fullest extent.
2017-09-14 19:45:40 +02:00
LockPersonality=yes
timesync: move stamp file to /var/lib/systemd/timesync/clock
2017-08-30 08:59:57 +02:00
StateDirectory=systemd/timesync
timesyncd: add unit and man page
2014-04-29 08:57:51 +02:00
[Install]
timesyncd: save clock to disk everytime we get an NTP fix, and bump clock at boot using this This is useful to make sure the system clock stays monotonic even on systems that lack an RTC. Also, why we are at it, also use the systemd release time for bumping the clock, since it's a slightly less bad than starting with jan 1st, 1970. This also moves timesyncd into the early bootphase, in order to make sure this initial bump is guaranteed to have finished by the time we start real daemons which might write to the file systemd and thus shouldn't leave 1970's timestamps all over the place...
2014-05-20 17:04:11 +02:00
WantedBy=sysinit.target
timesync: expose manager properties on bus
2018-04-30 16:02:09 +02:00
Alias=dbus-org.freedesktop.timesync1.service
Reference in a new issue Copy permalink