summaryrefslogtreecommitdiff
path: root/units/systemd-networkd.service.in
AgeCommit message (Collapse)Author
2014-06-03core: add new ReadOnlySystem= and ProtectedHome= settings for service unitsLennart Poettering
ReadOnlySystem= uses fs namespaces to mount /usr and /boot read-only for a service. ProtectedHome= uses fs namespaces to mount /home and /run/user inaccessible or read-only for a service. This patch also enables these settings for all our long-running services. Together they should be good building block for a minimal service sandbox, removing the ability for services to modify the operating system or access the user's private data.
2014-06-03networkd: drop CAP_SYS_MODULETom Gundersen
Rely on modules being built-in or autoloaded on-demand. As networkd is a network facing service, we want to limits its capabilities, as much as possible. Also, we may not have CAP_SYS_MODULE in a container, and we want networkd to work the same there. Module autoloading does not always work, but should be fixed by the kernel patch f98f89a0104454f35a: 'net: tunnels - enable module autoloading', which is currently in net-next and which people may consider backporting if they want tunneling support without compiling in the modules. Early adopters may also use a module-load.d snippet and order systemd-modules-load.service before networkd to force the module loading of tunneling modules. This sholud fix the various build issues people have reported.
2014-06-01networkd: run as unpriviliged "systemd-network" userLennart Poettering
This allows us to run networkd mostly unpriviliged with the exception of CAP_NET_* and CAP_SYS_MODULE. I'd really like to get rid of the latter though...
2014-06-01units: remove CAP_SYS_PTRACE capability from hostnamed/networkdLennart Poettering
The ptrace capability was only necessary to detect virtualizations environments. Since we changed the logic to determine this to not require priviliges, there's no need to carry the CAP_SYS_PTRACE capability anymore.
2014-05-16Revert "networkd: order after udev kernel socket"Tom Gundersen
This reverts commit a555350d47c4b70d716a63424933b34902c98300. This did not fix the problem, just made it harder to hit.
2014-05-12networkd: unit - add cap to load modulesTom Gundersen
Remember to drop this when the kernel gains autoloading for all netdev kinds.
2014-04-24networkd-wait-online: improve interoptability and enable by defaultTom Gundersen
To make sure we don't delay boot on systems where (some) network links are managed by someone else we don't block if something else has successfully brought up a link. We will still block until all links we are aware of that are managed by networkd have been configured, but if no such links exist, and someone else have configured a link sufficiently that it has a carrier, it may be that the link is ready so we should no longer block. Note that in all likelyhood the link is not ready (no addresses/routes configured), so whatever network managment daemon configured it should provide a similar wait-online service to block network-online.target until it is ready. The aim is to block as long as we know networking is not fully configured, but no longer. This will allow systemd-networkd-wait-online.service to be enabled on any system, even if we don't know whether networkd is the main/only network manager. Even in the case networking is fully configured by networkd, the default behavior may not be sufficient: if two links need to be configured, but the first is fully configured before the second one appears we will assume the network is up. To work around that, we allow specifying specific devices to wait for before considering the network up. This unit is enabled by default, just like systemd-networkd, but will only be pulled in if anyone pulls in network-online.target.
2014-04-19networkd: order after udev kernel socketTom Gundersen
Otherwise we will not be able to queuery whether devices are initialized on kdbus enabled systems.
2014-03-24networkd: add CapabilityBoundingSetTom Gundersen
2014-03-24units: networkd shouldn't have PrivateTmp= set, since it runs in early-bootLennart Poettering
/tmp is only available in later boot, and we shouldn't create private subdirs in it hence, while we are still in early boot.
2014-03-19core: enable PrivateNetwork= for a number of our long running services where ↵Lennart Poettering
this is useful
2014-02-21install: do not statically enable systemd-networkdJason A. Donenfeld
[tomegun: pruned the commit message as not to contradict the follow-up commit]
2014-01-18networkd: don't hard depend on system busTom Gundersen
We may not have a dbus daemon in the initrd (until we can rely on kdbus). In this case, simply ignore any attempts at using the bus. There is only one user for now, but surely more to come. In order to work reliably in the real root without kdbus, but at the same time don't delay boot when kdbus is in use, order ourselves after dbus.service.
2014-01-16sd-dhcp-client/networkd: add transient hostname supportTom Gundersen
2013-12-18units: run systemd-networkd.service only if CAP_NET_ADMIN capability is aroundLennart Poettering
This has the effect that systemd-networkd won't run in containers without network namespacing wher CAP_NET_ADMIN is (usually) not available. It will still run in containers with network namespacing on (where CAP_NET_ADMIN is usually avilable). We might remove this condition check again if networkd provides services to apps that also are useful in containers lacking network namespacing, however, as long as it doesn't it should be handled like udevd and be excluded in such containers.
2013-12-11event: hook up sd-event with the service watchdog logicLennart Poettering
Adds a new call sd_event_set_watchdog() that can be used to hook up the event loop with the watchdog supervision logic of systemd. If enabled and $WATCHDOG_USEC is set the event loop will ping the invoking systemd daemon right after coming back from epoll_wait() but not more often than $WATCHDOG_USEC/4. The epoll_wait() will sleep no longer than $WATCHDOG_USEC/4*3, to make sure the service manager is called in time. This means that setting WatchdogSec= in a .service file and calling sd_event_set_watchdog() in your daemon is enough to hook it up with the watchdog logic.
2013-11-23networkd: use Type=notifyTom Gundersen
Also start earlier during boot.
2013-11-09networkd: add a basic network daemonTom Gundersen
This daemon listens for and configures network devices tagged with 'systemd-networkd'. By default, no devices are tagged so this daemon can safely run in parallel with existing network daemons/scripts. Networks are configured in /etc/systemd/network/*.network. The first .network file that matches a given link is applied. The matching logic is similar to the one for .link files, but additionally supports matching on interface name. The mid-term aim is to provide an alternative to ad-hoc scripts currently used in initrd's and for wired setups that don't change much (e.g., as seen on servers/and some embedded systems). Currently, static addresses and a gateway can be configured. Example .network file: [Match] Name=wlp2s0 [Network] Description=My Network Gateway=192.168.1.1 Address=192.168.1.23/24 Address=fe80::9aee:94ff:fe3f:c618/64