systemd/units/systemd-importd.service.in

#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Virtual Machine and Container Download Service
Documentation=man:systemd-importd.service(8)

[Service]
ExecStart=@rootlibexecdir@/systemd-importd
BusName=org.freedesktop.import1
CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_SYS_ADMIN CAP_SETPCAP CAP_DAC_OVERRIDE
NoNewPrivileges=yes
WatchdogSec=1min
KillMode=mixed
import: introduce new mini-daemon systemd-importd, and make machinectl a client to it The old "systemd-import" binary is now an internal tool. We still use it as asynchronous backend for systemd-importd. Since the import tool might require some IO and CPU resources (due to qcow2 explosion, and decompression), and because we might want to run it with more minimal priviliges we still keep it around as the worker binary to execute as child process of importd. machinectl now has verbs for pulling down images, cancelling them and listing them. 2015-01-22 10:57:15 +08:00			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
			`# (at your option) any later version.`

			`[Unit]`
			`Description=Virtual Machine and Container Download Service`
			`Documentation=man:systemd-importd.service(8)`

			`[Service]`
			`ExecStart=@rootlibexecdir@/systemd-importd`
			`BusName=org.freedesktop.import1`
importd: add CAP_DAC_OVERRIDE capability Fedora's filesystem package ships /usr/bin (and other directories) which are not writable by its owner. machinectl pull-dkr (and possibly others) are not able to extract those: 14182 mkdirat(3, "usr", 0700) = 0 14182 mkdirat(3, "usr/bin", 0500) = 0 14182 openat(3, "usr/bin/[", O_WRONLY\|O_CREAT\|O_EXCL\|O_NOCTTY\|O_NONBLOCK\|O_CLOEXEC, 0700) = -1 EACCES (Permission denied) ... 2015-04-14 01:46:59 +08:00			`CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_SYS_ADMIN CAP_SETPCAP CAP_DAC_OVERRIDE`
importd: run daemon at minimal capabilities 2015-01-23 01:55:08 +08:00			`NoNewPrivileges=yes`
import: introduce new mini-daemon systemd-importd, and make machinectl a client to it The old "systemd-import" binary is now an internal tool. We still use it as asynchronous backend for systemd-importd. Since the import tool might require some IO and CPU resources (due to qcow2 explosion, and decompression), and because we might want to run it with more minimal priviliges we still keep it around as the worker binary to execute as child process of importd. machinectl now has verbs for pulling down images, cancelling them and listing them. 2015-01-22 10:57:15 +08:00			`WatchdogSec=1min`
units: set KillMode=mixed for our daemons that fork worker processes The daemons should really have the time to kill the workers first, before systemd does it, hence use KillMode=mixed for these daemons. https://bugs.freedesktop.org/show_bug.cgi?id=90051 2015-04-24 22:12:28 +08:00			`KillMode=mixed`