system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-10-15 12:34:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

units: make use of !! ExecStart= prefix in systemd-timesyncd.service

Browse source 
Let's make use of !! to run timesyncd with ambient capabilities on
systems supporting them.
This commit is contained in:
Yu Watanabe 2017-08-10 16:07:08 +09:00
parent c61f302d3c
commit 87a85e25a2
2 changed files with 12 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/timesync/timesyncd.c
View file

@ -111,9 +111,13 @@ int main(int argc, char *argv[]) {
if (r < 0) if (r < 0)
goto finish; goto finish;
r = drop_privileges(uid, gid, (1ULL << CAP_SYS_TIME)); /* Drop privileges, but only if we have been started as root. If we are not running as root we assume all
if (r < 0) * privileges are already dropped. */
goto finish; if (geteuid() == 0) {
r = drop_privileges(uid, gid, (1ULL << CAP_SYS_TIME));
if (r < 0)
goto finish;
}
assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0); assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);

8
units/systemd-timesyncd.service.in
View file

@ -12,7 +12,7 @@ ConditionCapability=CAP_SYS_TIME
ConditionVirtualization=!container ConditionVirtualization=!container
DefaultDependencies=no DefaultDependencies=no
RequiresMountsFor=/var/lib/systemd/clock RequiresMountsFor=/var/lib/systemd/clock
After=systemd-remount-fs.service systemd-tmpfiles-setup.service systemd-sysusers.service After=systemd-remount-fs.service systemd-sysusers.service
Before=time-sync.target sysinit.target shutdown.target Before=time-sync.target sysinit.target shutdown.target
Conflicts=shutdown.target Conflicts=shutdown.target
Wants=time-sync.target Wants=time-sync.target
@ -21,9 +21,11 @@ Wants=time-sync.target
Type=notify Type=notify
Restart=always Restart=always
RestartSec=0 RestartSec=0
ExecStart=@rootlibexecdir@/systemd-timesyncd ExecStart=!!@rootlibexecdir@/systemd-timesyncd
WatchdogSec=3min WatchdogSec=3min
CapabilityBoundingSet=CAP_SYS_TIME CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER User=systemd-timesync
CapabilityBoundingSet=CAP_SYS_TIME
AmbientCapabilities=CAP_SYS_TIME
PrivateTmp=yes PrivateTmp=yes
PrivateDevices=yes PrivateDevices=yes
ProtectSystem=strict ProtectSystem=strict