34 lines
1.3 KiB
SYSTEMD
34 lines
1.3 KiB
SYSTEMD
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=Report Signing Socket (Local Software Key)
|
|
Documentation=man:systemd-report-sign-plain@.service(8)
|
|
DefaultDependencies=no
|
|
Before=sockets.target shutdown.target
|
|
Conflicts=shutdown.target
|
|
WantsMountsFor=/var/lib/systemd/report.sign.plain
|
|
|
|
# The same binary serves two interfaces off one socket: an unprivileged metrics provider exposing our public
|
|
# key, and the privileged signing API. The actual socket node hence lives in the world-accessible metrics
|
|
# directory /run/systemd/report/, and the signing entrypoint is a symlink into the root-only
|
|
# /run/systemd/report.sign/ directory. Access to the signing method itself is restricted to root by the
|
|
# service (see vl_method_sign()); the directory permissions are merely an additional barrier.
|
|
[Socket]
|
|
ListenStream=/run/systemd/report/io.systemd.Report.SignPlain
|
|
Symlinks=/run/systemd/report.sign/plain
|
|
FileDescriptorName=varlink
|
|
SocketMode=0666
|
|
Accept=yes
|
|
MaxConnectionsPerSource=16
|
|
RemoveOnStop=yes
|
|
|
|
[Install]
|
|
WantedBy=sockets.target
|