3ca9940cb9
Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
36 lines
1.3 KiB
SYSTEMD
36 lines
1.3 KiB
SYSTEMD
# SPDX-License-Identifier: LGPL-2.1+
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=Virtual Machine and Container Registration Service
|
|
Documentation=man:systemd-machined.service(8)
|
|
Documentation=https://www.freedesktop.org/wiki/Software/systemd/machined
|
|
Wants=machine.slice
|
|
After=machine.slice
|
|
RequiresMountsFor=/var/lib/machines
|
|
|
|
[Service]
|
|
BusName=org.freedesktop.machine1
|
|
CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD
|
|
ExecStart=@rootlibexecdir@/systemd-machined
|
|
IPAddressDeny=any
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
NoNewPrivileges=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
|
|
RestrictRealtime=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallErrorNumber=EPERM
|
|
SystemCallFilter=@system-service @mount
|
|
WatchdogSec=3min
|
|
|
|
# Note that machined cannot be placed in a mount namespace, since it
|
|
# needs access to the host's mount namespace in order to implement the
|
|
# "machinectl bind" operation.
|