2019-11-12 14:54:22 +00:00
|
|
|
[Unit]
|
|
|
|
|
Description=Automatically configure NetworkManager in cloud
|
cloud-setup: let dispatcher script run tool only if service is enabled
We don't want that when the user installs the package, that the
dispatcher script automatically executes the tool. Instead, the user
should use `systemctl enable/disable` to control whether the service
is active (of via the timer).
Hence, let the dispatcher script check whether the service is enabled.
That leads to a different problem, that we need to make it possible for
"nm-cloud-setup.service" to be enabled in the first place. As such, add
a [Install] section and let it be wanted by NetworkManager.service. The
problem with this is that now the tool will run very early, just after
NetworkManager started. At that point, it might not yet have setup
networking. But that should be acceptable, after all, the tool either
fails to fetch meta data that early, or it succeeds. Very likely, it
will by aborted by dispatcher's restart command.
(cherry picked from commit 953e01336a1c062ee988d3dfe4650dd7c4ba2778)
2019-12-03 09:17:11 +00:00
|
|
|
After=NetworkManager.service
|
2019-11-12 14:54:22 +00:00
|
|
|
|
|
|
|
|
[Service]
|
|
|
|
|
Type=oneshot
|
|
|
|
|
ExecStart=@libexecdir@/nm-cloud-setup
|
|
|
|
|
|
|
|
|
|
#Environment=NM_CLOUD_SETUP_LOG=TRACE
|
2019-12-03 07:55:28 +00:00
|
|
|
|
2019-12-03 09:37:42 +00:00
|
|
|
# Cloud providers are disabled by default. You need to
|
|
|
|
|
# Opt-in by setting the right environment variable for
|
|
|
|
|
# the provider.
|
|
|
|
|
#Environment=NM_CLOUD_SETUP_EC2=yes
|
|
|
|
|
|
2019-12-03 07:55:28 +00:00
|
|
|
CapabilityBoundingSet=
|
|
|
|
|
LockPersonality=yes
|
|
|
|
|
MemoryDenyWriteExecute=yes
|
|
|
|
|
NoNewPrivileges=yes
|
|
|
|
|
PrivateDevices=yes
|
|
|
|
|
PrivateTmp=yes
|
|
|
|
|
ProtectControlGroups=yes
|
|
|
|
|
ProtectHome=yes
|
|
|
|
|
ProtectHostname=yes
|
|
|
|
|
ProtectKernelLogs=yes
|
|
|
|
|
ProtectKernelModules=yes
|
|
|
|
|
ProtectKernelTunables=yes
|
|
|
|
|
ProtectSystem=strict
|
|
|
|
|
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
|
|
|
|
|
RestrictNamespaces=yes
|
|
|
|
|
RestrictRealtime=yes
|
|
|
|
|
RestrictSUIDSGID=yes
|
|
|
|
|
SystemCallFilter=@system-service
|
cloud-setup: let dispatcher script run tool only if service is enabled
We don't want that when the user installs the package, that the
dispatcher script automatically executes the tool. Instead, the user
should use `systemctl enable/disable` to control whether the service
is active (of via the timer).
Hence, let the dispatcher script check whether the service is enabled.
That leads to a different problem, that we need to make it possible for
"nm-cloud-setup.service" to be enabled in the first place. As such, add
a [Install] section and let it be wanted by NetworkManager.service. The
problem with this is that now the tool will run very early, just after
NetworkManager started. At that point, it might not yet have setup
networking. But that should be acceptable, after all, the tool either
fails to fetch meta data that early, or it succeeds. Very likely, it
will by aborted by dispatcher's restart command.
(cherry picked from commit 953e01336a1c062ee988d3dfe4650dd7c4ba2778)
2019-12-03 09:17:11 +00:00
|
|
|
|
|
|
|
|
[Install]
|
|
|
|
|
WantedBy=NetworkManager.service
|
