From 8df87b4383b890192f88183d78e4d288e30443d6 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 7 Mar 2019 14:38:07 +0100 Subject: [PATCH 1/2] man: document that ProtectHostname= disables hostname change notifications --- man/systemd.exec.xml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index b8843f1ea0..19c7b26bce 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1135,9 +1135,13 @@ BindReadOnlyPaths=/var/lib/systemd Takes a boolean argument. When set, sets up a new UTS namespace for the executed processes. In addition, changing hostname or domainname is prevented. Defaults to off. - Note that the implementation of this setting might be impossible (for example if UTS namespaces are not - available), and the unit should be written in a way that does not solely rely on this setting for - security. + Note that the implementation of this setting might be impossible (for example if UTS namespaces + are not available), and the unit should be written in a way that does not solely rely on this setting + for security. + + Note that when this option is enabled for a service hostname changes no longer propagate from + the system into the service, it is hence not suitable for services that need to take notice of system + hostname changes dynamically. From a18449b5bd72308062724e70b9528d989d1f52a1 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 7 Mar 2019 14:38:11 +0100 Subject: [PATCH 2/2] units: turn of ProtectHostname= again for services hat need to know about system hostname changes ProtectHostname= turns off hostname change propagation from host to service. This means for services that care about the hostname and need to be able to notice changes to it it's not suitable (though it is useful for most other cases still). Let's turn it off hence for journald (which logs the current hostname) for networkd (which optionally sends the current hostname to dhcp servers) and resolved (which announces the current hostname via llmnr/mdns). --- units/systemd-journald.service.in | 1 - units/systemd-networkd.service.in | 1 - units/systemd-resolved.service.in | 1 - 3 files changed, 3 deletions(-) diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 1807d73c68..4684f095c0 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -23,7 +23,6 @@ IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes NoNewPrivileges=yes -ProtectHostname=yes Restart=always RestartSec=0 RestrictAddressFamilies=AF_UNIX AF_NETLINK diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index 5da0e1e330..472ef045de 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -27,7 +27,6 @@ MemoryDenyWriteExecute=yes NoNewPrivileges=yes ProtectControlGroups=yes ProtectHome=yes -ProtectHostname=yes ProtectKernelModules=yes ProtectSystem=strict Restart=on-failure diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in index eac3f31012..3144b70063 100644 --- a/units/systemd-resolved.service.in +++ b/units/systemd-resolved.service.in @@ -30,7 +30,6 @@ PrivateDevices=yes PrivateTmp=yes ProtectControlGroups=yes ProtectHome=yes -ProtectHostname=yes ProtectKernelModules=yes ProtectKernelTunables=yes ProtectSystem=strict