morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-15 00:47:10 +09:00
Code Issues Packages Projects Releases Wiki Activity
Files
cc20b387f8d869d07a86f254061c343d92b70c78
systemd/units/systemd-resolved.service.in

62 lines
1.9 KiB
SYSTEMD
Raw Normal View History

license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 13:23:58 +09:00
# SPDX-License-Identifier: LGPL-2.1-or-later
Add SPDX license headers to unit files
2017-11-18 17:35:03 +01:00
#
networkd: add missing files
2014-05-16 20:14:23 +02:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
resolved: add daemon to manage resolv.conf Also remove the equivalent functionality from networkd.
2014-05-18 22:10:48 +02:00
[Unit]
Description=Network Name Resolution
Documentation=man:systemd-resolved.service(8)
man,units: link to the new dbus-api man pages
2020-09-29 08:03:10 +02:00
Documentation=man:org.freedesktop.resolve1(5)
various: update links to more wiki pages
2024-05-28 14:37:23 +02:00
Documentation=https://systemd.io/WRITING_NETWORK_CONFIGURATION_MANAGERS
Documentation=https://systemd.io/WRITING_RESOLVER_CLIENTS
man,units: link to the new dbus-api man pages
2020-09-29 08:03:10 +02:00
resolved.service: set DefaultDependencies=no On systems that only use resolved for name resolution, there are usecases that require resolved to be started before sysinit target, such that network name resolution is available before network-online/sysinit targets. For example, cloud-init for some datasources hooks into the boot process ahead of sysinit target and may need network name resolution at that point already. systemd-resolved already starts pretty early in the process, thus starting it slightly earlier should not have negative side effects. However, this depends on resolved ability to connect to system DBus once that is up.
2017-12-11 18:27:49 +00:00
DefaultDependencies=no
units: unify deps between service and socket units The current arrangement of service and socket units is sort of all over the place. Let's clean it up a little, roughly following the principles below: - socket units have implicit ordering deps (not to be confused with default ones which are subject to DefaultDependencies=) before associated service, so drop any explicit After= - If socket can be enabled, remember to link to it in service via Also= and Sockets= (the latter replaces Wants=). If the service Requires= socket however, Sockets= is omitted. - If socket is statically enabled, no need for service to pull it in - machined
2025-04-30 21:05:02 +02:00
After=systemd-sysctl.service systemd-sysusers.service
units: Shut down networkd and resolved on switch-root Let's explicitly order these against initrd-switch-root.target, so that they are properly shut down before we switch root. Otherwise, there's a race condition where networkd might only shut down after switching root and after we've already we've loaded the unit graph, meaning it won't be restarted in the rootfs. Fixes #27718
2023-05-25 18:13:02 +02:00
Before=sysinit.target network.target nss-lookup.target shutdown.target initrd-switch-root.target
Conflicts=shutdown.target initrd-switch-root.target
units: unify deps between service and socket units The current arrangement of service and socket units is sort of all over the place. Let's clean it up a little, roughly following the principles below: - socket units have implicit ordering deps (not to be confused with default ones which are subject to DefaultDependencies=) before associated service, so drop any explicit After= - If socket can be enabled, remember to link to it in service via Also= and Sockets= (the latter replaces Wants=). If the service Requires= socket however, Sockets= is omitted. - If socket is statically enabled, no need for service to pull it in - machined
2025-04-30 21:05:02 +02:00
Wants=nss-lookup.target
resolved: add daemon to manage resolv.conf Also remove the equivalent functionality from networkd.
2014-05-18 22:10:48 +02:00
[Service]
units: make use of the new !! ExecStart= prefix in systemd-resolved.service Let's make use of !! to run resolved with ambient capabilities on systems supporting them.
2017-08-09 16:15:07 +02:00
AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
unit: declare BusName= in all our units that are on the bus, event if they don't use Type=dbus This information is always useful, so let's always declare it, particular in the light of #16976.
2020-09-11 10:56:06 +02:00
BusName=org.freedesktop.resolve1
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 17:19:48 +01:00
CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
tree-wide: remove support for kernels lacking ambient caps Let's bump the kernel baseline a bit to 4.3 and thus require ambient caps. This allows us to remove support for a variety of special casing, most importantly the ExecStart=!! hack.
2024-12-12 13:42:12 +01:00
ExecStart={{LIBEXECDIR}}/systemd-resolved
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 17:19:48 +01:00
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 13:23:27 +02:00
PrivateDevices=yes
units: use PrivateTmp=disconnected instead of 'yes' if DefaultDependencies=no Avoids subtle race conditions such as the one described at #35582. Fixes #35582
2024-12-12 11:48:52 +00:00
PrivateTmp=disconnected
units: add ProtectClock=yes Add `ProtectClock=yes` to systemd units. Since it implies certain `DeviceAllow=` rules, make sure that the units have `DeviceAllow=` rules so they are still able to access other devices. Exclude timesyncd and timedated.
2020-04-02 21:18:11 +03:00
ProtectClock=yes
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 13:23:27 +02:00
ProtectControlGroups=yes
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 17:19:48 +01:00
ProtectHome=yes
units: turn on ProtectProc= wherever suitable
2020-08-06 14:50:38 +02:00
ProtectKernelLogs=yes
units: turn on ProtectKernelModules= for most long-running services
2017-02-09 11:09:50 +01:00
ProtectKernelModules=yes
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 17:19:48 +01:00
ProtectKernelTunables=yes
ProtectSystem=strict
Restart=always
RestartSec=0
units: further lock down our long-running services Let's make this an excercise in dogfooding: let's turn on more security features for all our long-running services. Specifically: - Turn on RestrictRealtime=yes for all of them - Turn on ProtectKernelTunables=yes and ProtectControlGroups=yes for most of them - Turn on RestrictAddressFamilies= for all of them, but different sets of address families for each Also, always order settings in the unit files, that the various sandboxing features are close together. Add a couple of missing, older settings for a numbre of unit files. Note that this change turns off AF_INET/AF_INET6 from udevd, thus effectively turning of networking from udev rule commands. Since this might break stuff (that is already broken I'd argue) this is documented in NEWS.
2016-08-26 13:23:27 +02:00
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 17:19:48 +01:00
RestrictNamespaces=yes
RestrictRealtime=yes
units: turn on RestrictSUIDSGID= in most of our long-running daemons
2019-03-20 19:52:20 +01:00
RestrictSUIDSGID=yes
units: make use of the new !! ExecStart= prefix in systemd-resolved.service Let's make use of !! to run resolved with ambient capabilities on systems supporting them.
2017-08-09 16:15:07 +02:00
RuntimeDirectory=systemd/resolve
RuntimeDirectoryPreserve=yes
units: unify deps between service and socket units The current arrangement of service and socket units is sort of all over the place. Let's clean it up a little, roughly following the principles below: - socket units have implicit ordering deps (not to be confused with default ones which are subject to DefaultDependencies=) before associated service, so drop any explicit After= - If socket can be enabled, remember to link to it in service via Also= and Sockets= (the latter replaces Wants=). If the service Requires= socket however, Sockets= is omitted. - If socket is statically enabled, no need for service to pull it in - machined
2025-04-30 21:05:02 +02:00
Sockets=systemd-resolved-varlink.socket systemd-resolved-monitor.socket
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 17:19:48 +01:00
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service
resolved: support reloading configuration at runtime Drop connections and caches and reload config from files, to allow for low-interruptions updates, and hook up to the usual SIGHUP and ExecReload=. Mark servers and services configured directly via D-Bus so that they can be kept around, and only the configuration file settings are dropped and reloaded. Fixes https://github.com/systemd/systemd/issues/17503 Fixes https://github.com/systemd/systemd/issues/20604
2024-03-08 23:02:19 +00:00
Type=notify-reload
units: set NoNewPrivileges= for all long-running services Previously, setting this option by default was problematic due to SELinux (as this would also prohibit the transition from PID1's label to the service's label). However, this restriction has since been lifted, hence let's start making use of this universally in our services. On SELinux system this change should be synchronized with a policy update that ensures that NNP-ful transitions from init_t to service labels is permitted. An while we are at it: sort the settings in the unit files this touches. This might increase the size of the change in this case, but hopefully should result in stabler patches later on. Fixes: #1219
2018-11-12 17:19:48 +01:00
User=systemd-resolve
units: Use ImportCredential= where applicable
2023-06-08 14:09:36 +02:00
ImportCredential=network.dns
ImportCredential=network.search_domains
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 11:55:36 +02:00
{{SERVICE_WATCHDOG}}
resolved: add daemon to manage resolv.conf Also remove the equivalent functionality from networkd.
2014-05-18 22:10:48 +02:00
[Install]
units: move resolved to sysinit.target (from basic.target) 79a67f3ca4d32c37b5e754501852a85eae908a6a pulled systemd-resolved.service in from basic.target instead of multi-user.target, i.e. the idea is to make it an early boot service, instead of a regular service. However, early boot services are supposed to be in sysinit.target, not basic.target (the latter is just one that combines the early boot services in sysinit.target, the sockets in sockets.targt, the mounts in local-fs.target and so on into one big target). Also, the comit actually didn't add a synchronization point, i.e. not Before=, so that the whole thing was racy. Let's fix all that. Follow-up for 79a67f3ca4d32c37b5e754501852a85eae908a6a
2022-02-03 12:15:00 +01:00
WantedBy=sysinit.target
units: enable resolved bus activation though a symlink in /etc The change: -/usr/lib/systemd/system/dbus-org.freedesktop.resolve1.service +/etc/systemd/system/dbus-org.freedesktop.resolve1.service If resolved is disabled, without this, talking to the resolved bus API will activate it regardless whether it is enabled or not, let's fix that.
2017-02-16 17:48:48 +01:00
Alias=dbus-org.freedesktop.resolve1.service
resolved: support socket activation via varlink sockets Add two new socket units, one for each of systemd-resolved's varlink servers: systemd-resolved-varlink.socket systemd-resolved-monitor.socket Add logic to grab socket fds via sd_varlink_server_listen_name(), but fallback to the existing sd_varlink_server_listen_address() calls if no fds were given. This will be used to make systemd-networkd-wait-online --dns more robust against systemd-resolved restarts etc.
2025-04-29 15:14:32 -04:00
Also=systemd-resolved-varlink.socket systemd-resolved-monitor.socket
Reference in New Issue Copy Permalink