picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

units: set SystemCallArchitectures=native on all our long-running services

This commit is contained in:
Lennart Poettering 2017-02-08 22:32:37 +01:00
parent 357e1b17b9
commit 7f396e5f66
18 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
units/systemd-ask-password-console.service.in
View File

@ -16,3 +16,4 @@ ConditionPathExists=!/run/plymouth/pid
[Service]
ExecStart=@rootbindir@/systemd-tty-ask-password-agent --watch --console
SystemCallArchitectures=native

1
units/systemd-ask-password-wall.service.in
View File

@ -13,3 +13,4 @@ After=systemd-user-sessions.service
[Service]
ExecStartPre=-@SYSTEMCTL@ stop systemd-ask-password-console.path systemd-ask-password-console.service systemd-ask-password-plymouth.path systemd-ask-password-plymouth.service
ExecStart=@rootbindir@/systemd-tty-ask-password-agent --wall
SystemCallArchitectures=native

1
units/systemd-coredump@.service.in
View File

@ -22,3 +22,4 @@ OOMScoreAdjust=500
PrivateNetwork=yes
ProtectSystem=full
RuntimeMaxSec=5min
SystemCallArchitectures=native

1
units/systemd-hostnamed.service.in
View File

@ -26,3 +26,4 @@ MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
SystemCallArchitectures=native

1
units/systemd-importd.service.in
View File

@ -21,3 +21,4 @@ MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io
SystemCallArchitectures=native

3
units/systemd-initctl.service.in
View File

@ -11,5 +11,6 @@ Documentation=man:systemd-initctl.service(8)
DefaultDependencies=no
[Service]
ExecStart=@rootlibexecdir@/systemd-initctl
NotifyAccess=all
ExecStart=@rootlibexecdir@/systemd-initctl
SystemCallArchitectures=native

1
units/systemd-journal-gatewayd.service.in
View File

@ -25,6 +25,7 @@ ProtectKernelTunables=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
# If there are many split upjournal files we need a lot of fds to
# access them all and combine

1
units/systemd-journal-remote.service.in
View File

@ -25,6 +25,7 @@ ProtectKernelTunables=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
[Install]
Also=systemd-journal-remote.socket

1
units/systemd-journal-upload.service.in
View File

@ -25,6 +25,7 @@ ProtectKernelTunables=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallArchitectures=native
# If there are many split up journal files we need a lot of fds to
# access them all and combine

1
units/systemd-journald.service.in
View File

@ -28,6 +28,7 @@ MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
SystemCallArchitectures=native
# Increase the default a bit in order to allow many simultaneous
# services being run since we keep one fd open per service. Also, when

1
units/systemd-localed.service.in
View File

@ -26,3 +26,4 @@ MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
SystemCallArchitectures=native

1
units/systemd-logind.service.in
View File

@ -29,6 +29,7 @@ MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io
SystemCallArchitectures=native
# Increase the default a bit in order to allow many simultaneous
# logins since we keep one fd open per session.

1
units/systemd-machined.service.in
View File

@ -21,6 +21,7 @@ MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io
SystemCallArchitectures=native
# Note that machined cannot be placed in a mount namespace, since it
# needs access to the host's mount namespace in order to implement the

1
units/systemd-networkd.service.m4.in
View File

@ -35,6 +35,7 @@ MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
SystemCallArchitectures=native
[Install]
WantedBy=multi-user.target

1
units/systemd-resolved.service.m4.in
View File

@ -35,6 +35,7 @@ MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
SystemCallArchitectures=native
[Install]
WantedBy=multi-user.target

1
units/systemd-timedated.service.in
View File

@ -24,3 +24,4 @@ MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX
SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
SystemCallArchitectures=native

1
units/systemd-timesyncd.service.in
View File

@ -34,6 +34,7 @@ MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io
SystemCallArchitectures=native
[Install]
WantedBy=sysinit.target

1
units/systemd-udevd.service.in
View File

@ -28,3 +28,4 @@ MountFlags=slave
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
SystemCallArchitectures=native