From de8f039cf3a527c87ec595fc94a691b0159cd79a Mon Sep 17 00:00:00 2001 From: Jernej Jakob Date: Thu, 11 Jun 2020 08:04:29 +0200 Subject: vyos-hostsd: T2583: update systemd service - set RuntimeDirectory to vyos-hostsd - set RuntimeDirectoryPreserve in order to not delete the state file between service restarts (/run will be deleted across reboots as it's on a tmpfs but the state doesn't need to be saved across reboots anyway) - set WorkingDirectory to /run/vyos-hostsd --- src/systemd/vyos-hostsd.service | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src/systemd/vyos-hostsd.service') diff --git a/src/systemd/vyos-hostsd.service b/src/systemd/vyos-hostsd.service index 731e570c9..db8f630d4 100644 --- a/src/systemd/vyos-hostsd.service +++ b/src/systemd/vyos-hostsd.service @@ -10,6 +10,9 @@ DefaultDependencies=no After=systemd-remount-fs.service [Service] +WorkingDirectory=/run/vyos-hostsd +RuntimeDirectory=vyos-hostsd +RuntimeDirectoryPreserve=yes ExecStart=/usr/bin/python3 -u /usr/libexec/vyos/services/vyos-hostsd Type=idle KillMode=process -- cgit v1.2.3 From 96ed330e9691f9db79c837505802ae5055f86348 Mon Sep 17 00:00:00 2001 From: Jernej Jakob Date: Thu, 11 Jun 2020 08:06:14 +0200 Subject: vyos-hostsd: T2583: add hostsd group To better control access from other daemons that may not be running as root, create a new group 'hostsd' to which the other daemons running users can be added. Run vyos-hostsd as root:hostsd to create the socket file with correct user and group. --- debian/vyos-1x.postinst | 5 +++++ src/systemd/vyos-hostsd.service | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) (limited to 'src/systemd/vyos-hostsd.service') diff --git a/debian/vyos-1x.postinst b/debian/vyos-1x.postinst index a308401ee..672f90dff 100644 --- a/debian/vyos-1x.postinst +++ b/debian/vyos-1x.postinst @@ -19,3 +19,8 @@ if ! grep -q '^minion' /etc/passwd; then adduser --quiet minion disk adduser --quiet minion users fi + +# add hostsd group for vyos-hostsd +if ! grep -q '^hostsd' /etc/group; then + addgroup --quiet --system hostsd +fi diff --git a/src/systemd/vyos-hostsd.service b/src/systemd/vyos-hostsd.service index db8f630d4..b77335778 100644 --- a/src/systemd/vyos-hostsd.service +++ b/src/systemd/vyos-hostsd.service @@ -24,7 +24,7 @@ Restart=on-failure # Does't work in Jessie but leave it here User=root -Group=vyattacfg +Group=hostsd [Install] -- cgit v1.2.3