units: document why CAP_SYS_PTRACE is needed by journald
This commit is contained in:
parent
48e0abb535
commit
c7faa23235
|
@ -16,7 +16,6 @@ After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-a
|
||||||
Before=sysinit.target
|
Before=sysinit.target
|
||||||
|
|
||||||
[Service]
|
[Service]
|
||||||
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
|
|
||||||
DeviceAllow=char-* rw
|
DeviceAllow=char-* rw
|
||||||
ExecStart=@rootlibexecdir@/systemd-journald
|
ExecStart=@rootlibexecdir@/systemd-journald
|
||||||
FileDescriptorStoreMax=4224
|
FileDescriptorStoreMax=4224
|
||||||
|
@ -42,6 +41,11 @@ SystemCallFilter=@system-service
|
||||||
Type=notify
|
Type=notify
|
||||||
@SERVICE_WATCHDOG@
|
@SERVICE_WATCHDOG@
|
||||||
|
|
||||||
|
# In case you're wondering why CAP_SYS_PTRACE is needed, access to
|
||||||
|
# /proc/<pid>/exec requires this capability. Thus if this cap is missing
|
||||||
|
# _EXE/OBJECT_EXE fields will be missing from the journal entries.
|
||||||
|
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
|
||||||
|
|
||||||
# If there are many split up journal files we need a lot of fds to access them
|
# If there are many split up journal files we need a lot of fds to access them
|
||||||
# all in parallel.
|
# all in parallel.
|
||||||
LimitNOFILE=@HIGH_RLIMIT_NOFILE@
|
LimitNOFILE=@HIGH_RLIMIT_NOFILE@
|
||||||
|
|
Loading…
Reference in New Issue