/mandos/trunk : changes

» Changes to mandos.service from revision 1332

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

From Revision 1332

expand all

Rev	Summary	Authors	Date
1330	Add systemd dependency on dbus.socket Add systemd dependency on dbus.socket If the Mandos server is installed at the exact same time that the D-Bus daemon is being installed, it is possible that the D-Bus daemon is installed, but, crucially, not configured or started, when the Mandos server is started. This makes the Mandos server fail to start, since it can't connect to the D-Bus system bus. This is only a problem at that first install time; if the system is restarted, everything works. I.e. it is not a problem in the most common case where the Mandos server is installed after the D-Bus server has already been installed and is running. However, it can sometimes be a problem. In particular, this seems to be a problem on the Debian CI servers, which installs all required packages at the same time. For Debian packages, for strict dependencies, there is a solution for this in the "Pre-Depends" header in the Debian package "control" file (deb-control(5)). There is, however, no such analogous thing for non-strict dependencies. The Mandos server does not have a strict dependency on a D-Bus daemon (since a Mandos server can be configured to run without using D-Bus at all), so we do not want to introduce such a dependency. Debian package dependencies are hard for system administrators to override, but a systemd service options are relatively easy to overide. Therefore, as far as I know, adding this systemd dependency is all we can do, currently. * mandos.service ([Unit]/After): Add "dbus.socket".	Teddy Hogeborn	8 hours ago
1203	Allow users to more easily alter mandos.service Allow users to more easily alter mandos.service The sysvinit script uses /etc/default/mandos as an environment file, and supports adding additional server options to a DAEMON_ARGS environment variable. This should be supported by the systemd service, too. * mandos.service ([Service]/EnvironmentFile): New; set to "/etc/default/mandos ". ([Service]/ExecStart): Append "$DAEMON_ARGS".	teddy at recompile	6 years ago
905	Add some more restrictions to the systemd service file. Add some more restrictions to the systemd service file. * mandos.service ([Service]/ProtectKernelTunables): New; set to "yes". ([Service]/ProtectControlGroups): - '' -	Teddy Hogeborn	8 years ago
887	"RequisiteOverridable" is deprecated in systemd unit files "RequisiteOverridable" is deprecated in systemd unit files * mandos.service ([Unit]/RequisiteOverridable): Change to "Requisite".	Teddy Hogeborn	9 years ago
831	Server: Fix bug where it did not exit timely on signals Server: Fix bug where it did not exit timely on signals Use GLib.unix_signal_add() instead of signal.signal() to catch signals; this will allow GLib to do its internal magic with signal file descriptors. (GLib does not handle signals properly otherwise.) The function unix_signal_add() requires GLib 2.30 or later, which was not required by PyGobject until version 3.7.1, so depend on this. * INSTALL (Mandos Server): Document dependency on PyGObject 3.7.1 * mandos (main): Use GLib.unix_signal_add instead of signal.signal. * init.d-mandos (do_stop): Remove workaround. * mandos.service ([Service]): - '' -	Teddy Hogeborn	10 years ago
826	Server bug fix: Work around bug when stopping server Server bug fix: Work around bug when stopping server * init.d-mandos (do_stop): Work around SIGTERM ignoring bug by doing "mandos-ctl >/dev/null 2>&1" after sending signal. * mandos.service (ExecStop): New; set to "/bin/kill -TERM $MAINPID ; /usr/sbin/mandos-ctl >/dev/null 2>&1" to work around SIGTERM ignoring bug.	Teddy Hogeborn	10 years ago
825	Server bug fix: Include CAP_SETGID so it does not run as roo... Server bug fix: Include CAP_SETGID so it does not run as root * debian/mandos.postinst (configure): If old version was 1.7.4-1 or 1.7.4-1~bpo8+1, fix situation where clients.pickle file is owned by root. * mandos (main): Print debug info about setuid() and setgid() * mandos.service ([Service]/CapabilityBoundingSet): Add "CAP_KILL CAP_SETGID"; the latter is needed for setgid() to be allowed.	Teddy Hogeborn	10 years ago
818	Restrict the Mandos server daemon in the systemd service fil... Restrict the Mandos server daemon in the systemd service file. * mandos.service ([Service]/ProtectSystem): Set to "full". ([Service]/PrivateTmp, [Service]/PrivateDevices, [Service]/ProtectHome): Set to "yes". ([Service]/CapabilityBoundingSet): Set to "CAP_SETUID CAP_DAC_OVERRIDE CAP_NET_RAW".	Teddy Hogeborn	10 years ago
787	Depend on Avahi and the network in the server's systemd serv... Depend on Avahi and the network in the server's systemd service file. * mandos.service ([Unit]/After): New; set to "network.target" and "avahi-daemon.service". ([Unit]/RequisiteOverridable): New; set to "avahi-daemon.service".	Teddy Hogeborn	10 years ago
761	mandos.service: Use Type=dbus (implicitly). mandos.service: Use Type=dbus (implicitly). mandos.service ([Service]/Type): Removed. ([Service]/BusName): Uncommented; set to "se.recompile.Mandos".	Teddy Hogeborn	10 years ago
757	mandos.service ([Service]/KillMode): Changed to "mixed". mandos.service ([Service]/KillMode): Changed to "mixed".	Teddy Hogeborn	10 years ago
734	* mandos.service ([Unit]/Documentation): New. * mandos.service ([Unit]/Documentation): New.	Teddy Hogeborn	11 years ago
726	Do not set BusName in systemd service file for Mandos server... Do not set BusName in systemd service file for Mandos server. It was not documented what this did for non-"dbus" service types, but apparently systemd now shows a warning about this. * mandos.service (BusName): Commented out.	Teddy Hogeborn	11 years ago
647	Specify BusName in systemd service file. Specify BusName in systemd service file. * mandos.service (BusName): Uncommented.	Teddy Hogeborn	12 years ago
638	Add systemd service support for Mandos server. Add systemd service support for Mandos server. * Makefile (SYSTEMD): New; systemd system unit directory. (install-server): Install mandos.service. (purge-server): Remove mandos.service. * debian/control (Build-Depends): Added "systemd". * init.d-mandos (Description): Updated. * mandos.service: New.	Teddy Hogeborn	12 years ago