From d0e62ae0f6d05657a9bec134cefb0994d9734e67 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 2 Aug 2017 17:35:11 +0900 Subject: [PATCH 1/3] units: use {State,Logs}Directory= if they are applicable --- units/systemd-coredump@.service.in | 2 +- units/systemd-journal-remote.service.in | 2 +- units/systemd-journal-upload.service.in | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index 18f2d2d605..f6044a4d3f 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -34,4 +34,4 @@ RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap SystemCallArchitectures=native -ReadWritePaths=/var/lib/systemd/coredump +StateDirectory=systemd/coredump diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index 5404bf1c03..62e862a837 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -28,7 +28,7 @@ RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallArchitectures=native -ReadWritePaths=/var/log/journal/remote +LogsDirectory=journal/remote [Install] Also=systemd-journal-remote.socket diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index d00b929211..b0bee3925e 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -28,7 +28,7 @@ RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallArchitectures=native -ReadWritePaths=/var/lib/systemd/journal-upload +StateDirectory=systemd/journal-upload # If there are many split up journal files we need a lot of fds to # access them all and combine From 29444df23bea21c15a3284ad8acfe2f008e5dbae Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Thu, 27 Jul 2017 18:05:29 +0900 Subject: [PATCH 2/3] tmpfiles: drop systemd-remote.conf The directories are only used by the specific services, and created before the services are started. So, it is not necessary to create them by systemd-tmpfiles. --- tmpfiles.d/meson.build | 1 - tmpfiles.d/systemd-remote.conf.m4 | 17 ----------------- 2 files changed, 18 deletions(-) delete mode 100644 tmpfiles.d/systemd-remote.conf.m4 diff --git a/tmpfiles.d/meson.build b/tmpfiles.d/meson.build index 29efe21f9d..7d21c64708 100644 --- a/tmpfiles.d/meson.build +++ b/tmpfiles.d/meson.build @@ -22,7 +22,6 @@ endforeach m4_files = [['etc.conf', ''], ['systemd.conf', ''], - ['systemd-remote.conf', 'ENABLE_REMOTE'], ['var.conf', ''], ] diff --git a/tmpfiles.d/systemd-remote.conf.m4 b/tmpfiles.d/systemd-remote.conf.m4 deleted file mode 100644 index 7a0f698c11..0000000000 --- a/tmpfiles.d/systemd-remote.conf.m4 +++ /dev/null @@ -1,17 +0,0 @@ -# This file is part of systemd. -# -# systemd is free software; you can redistribute it and/or modify it -# under the terms of the GNU Lesser General Public License as published by -# the Free Software Foundation; either version 2.1 of the License, or -# (at your option) any later version. - -# See tmpfiles.d(5) for details -m4_ifdef(`HAVE_LIBCURL', - -d /var/lib/systemd/journal-upload 0755 systemd-journal-upload systemd-journal-upload - - -)m4_dnl -m4_ifdef(`HAVE_MICROHTTPD', - -z /var/log/journal/remote 2755 systemd-journal-remote systemd-journal-remote - - -z /run/log/journal/remote 2755 systemd-journal-remote systemd-journal-remote - - -)m4_dnl From debe5d23760f7a1261bcd26f5f523acf225e75de Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 2 Aug 2017 18:06:47 +0900 Subject: [PATCH 3/3] unit: remove redundant options --- units/systemd-journal-gatewayd.service.in | 4 ---- units/systemd-journal-remote.service.in | 1 - 2 files changed, 5 deletions(-) diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in index 42da3504b8..fd7a9718f7 100644 --- a/units/systemd-journal-gatewayd.service.in +++ b/units/systemd-journal-gatewayd.service.in @@ -12,14 +12,10 @@ Requires=systemd-journal-gatewayd.socket [Service] ExecStart=@rootlibexecdir@/systemd-journal-gatewayd -User=systemd-journal-gateway -Group=systemd-journal-gateway SupplementaryGroups=systemd-journal DynamicUser=yes -PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index 62e862a837..c24e673d82 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -13,7 +13,6 @@ Requires=systemd-journal-remote.socket [Service] ExecStart=@rootlibexecdir@/systemd-journal-remote --listen-https=-3 --output=/var/log/journal/remote/ User=systemd-journal-remote -Group=systemd-journal-remote WatchdogSec=3min PrivateTmp=yes PrivateDevices=yes