diff options
Diffstat (limited to 'data')
| -rw-r--r-- | data/NetworkManager-dispatcher.service.in | 7 | ||||
| -rw-r--r-- | data/meson.build | 1 | ||||
| -rw-r--r-- | data/nm-priv-helper.service.in | 79 |
3 files changed, 87 insertions, 0 deletions
diff --git a/data/NetworkManager-dispatcher.service.in b/data/NetworkManager-dispatcher.service.in index c450478b..1a45f353 100644 --- a/data/NetworkManager-dispatcher.service.in +++ b/data/NetworkManager-dispatcher.service.in @@ -5,6 +5,13 @@ Description=Network Manager Script Dispatcher Service Type=dbus BusName=org.freedesktop.nm_dispatcher ExecStart=@libexecdir@/nm-dispatcher +NotifyAccess=main + +# Enable debug logging in dispatcher service. Note that dispatcher +# also honors debug logging requests from NetworkManager, so you +# can also control logging requests with +# `nmcli general logging domain DISPATCHER level TRACE`. +#Environment=NM_DISPATCHER_DEBUG_LOG=1 # We want to allow scripts to spawn long-running daemons, so tell # systemd to not clean up when nm-dispatcher exits diff --git a/data/meson.build b/data/meson.build index 64a1372b..35e3de52 100644 --- a/data/meson.build +++ b/data/meson.build @@ -11,6 +11,7 @@ if install_systemdunitdir services = [ 'NetworkManager-dispatcher.service.in', 'NetworkManager.service.in', + 'nm-priv-helper.service.in', ] if have_systemd_200 diff --git a/data/nm-priv-helper.service.in b/data/nm-priv-helper.service.in new file mode 100644 index 00000000..aa028e6c --- /dev/null +++ b/data/nm-priv-helper.service.in @@ -0,0 +1,79 @@ +[Unit] +Description=NetworkManager Privileged Helper + +# +# nm-priv-helper exists for privilege separation. It allows to run +# NetworkManager without certain capabilities, and ask nm-priv-helper +# for special operations where more privileges are required. +# + +# While nm-priv-helper has privileges that NetworkManager has not, it +# does not mean that itself should run totally unconstrained. On the +# contrary, it also should only have permissions it requires. +# +# nm-priv-helper rejects all requests that come from any other than the +# name owner of "org.freedesktop.NetworkManager" (that is, +# NetworkManager process itself). It is thus only an implementation +# detail and provides no public API to the user. + +[Service] +Type=dbus +BusName=org.freedesktop.nm-priv-helper +ExecStart=@libexecdir@/nm-priv-helper +NotifyAccess=main + +# Extra configuration options. Set via `systemctl edit +# nm-priv-helper.service`: +# +# FOR TESTING ONLY: disable authentication to allow requests from +# everybody. Don't set this outside of testing! +#Environment=NM_PRIV_HELPER_NO_AUTH_FOR_TESTING=1 +# +# The logging level for debug messages (to stdout). +#Environment=NM_PRIV_HELPER_LOG=TRACE +# +# nm-priv-helper will exit on idle after timeout. Set timeout here or +# set to 2147483647 for infinity. + +#Environment=NM_PRIV_HELPER_IDLE_TIMEOUT_MSEC=10000 + + +# Restrict: +AmbientCapabilities= +CapabilityBoundingSet= +PrivateDevices=true +PrivateMounts=true +PrivateNetwork=true +PrivateTmp=true +ProtectClock=true +ProtectControlGroups=true +ProtectHome=true +ProtectHostname=true +ProtectKernelLogs=true +ProtectKernelModules=true +ProtectKernelTunables=true +ProtectSystem=strict +RestrictAddressFamilies= +RestrictNamespaces=true +SystemCallFilter=~@clock +SystemCallFilter=~@cpu-emulation +SystemCallFilter=~@debug +SystemCallFilter=~@module +SystemCallFilter=~@mount +SystemCallFilter=~@obsolete +SystemCallFilter=~@privileged +SystemCallFilter=~@raw-io +SystemCallFilter=~@reboot +SystemCallFilter=~@swap +NoNewPrivileges=true +SupplementaryGroups= + +# Grant: +CapabilityBoundingSet=CAP_DAC_OVERRIDE +PrivateUsers=no +RestrictAddressFamilies=AF_UNIX +SystemCallFilter=@resources + + +[Install] +Alias=dbus-org.freedesktop.nm-priv-helper.service |