3ca9940cb9
Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
42 lines
1.1 KiB
SYSTEMD
42 lines
1.1 KiB
SYSTEMD
# SPDX-License-Identifier: LGPL-2.1+
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=Journal Remote Upload Service
|
|
Documentation=man:systemd-journal-upload(8)
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
DynamicUser=yes
|
|
ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHome=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
StateDirectory=systemd/journal-upload
|
|
SupplementaryGroups=systemd-journal
|
|
SystemCallArchitectures=native
|
|
User=systemd-journal-upload
|
|
WatchdogSec=3min
|
|
|
|
# If there are many split up journal files we need a lot of fds to access them
|
|
# all in parallel.
|
|
LimitNOFILE=@HIGH_RLIMIT_NOFILE@
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|