mirror of
https://gitlab.com/chrony/chrony.git
synced 2025-12-04 12:15:07 -05:00
cb1118456b
On Linux, if the NOTIFY_SOCKET variable is set, send a "READY=1" and "STOPPING=1" message to the Unix domain socket after initialization and before finalization respectively. This is used with the systemd "notify" service type as documented in the sd_notity(3) man page. It's a recommended alternative to the "forking" service type, which does not need the PID file to determine the main process. Support pathname Unix sockets only. Abstract sockets don't seem to be used by systemd for notifications since version 212. Switch the example services to the notify type, but keep the PID file. It's still useful to prevent start of other chronyd instances. systemd doesn't seem to care about the content of the file and should just remove it in case chronyd didn't terminate cleanly. Suggested-by: Luca Boccassi <bluca@debian.org>
49 lines
1.5 KiB
Desktop File
49 lines
1.5 KiB
Desktop File
[Unit]
|
|
Description=NTP client/server
|
|
Documentation=man:chronyd(8) man:chrony.conf(5)
|
|
After=ntpdate.service sntp.service ntpd.service
|
|
Conflicts=ntpd.service systemd-timesyncd.service
|
|
ConditionCapability=CAP_SYS_TIME
|
|
|
|
[Service]
|
|
Type=notify
|
|
PIDFile=/run/chrony/chronyd.pid
|
|
EnvironmentFile=-/etc/sysconfig/chronyd
|
|
ExecStart=/usr/sbin/chronyd -n $OPTIONS
|
|
|
|
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
|
|
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE
|
|
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_MKNOD CAP_SYS_ADMIN
|
|
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_PACCT
|
|
CapabilityBoundingSet=~CAP_SYS_PTRACE CAP_SYS_RAWIO CAP_SYS_TTY_CONFIG CAP_WAKE_ALARM
|
|
DeviceAllow=char-pps rw
|
|
DeviceAllow=char-ptp rw
|
|
DeviceAllow=char-rtc rw
|
|
DevicePolicy=closed
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHome=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectProc=invisible
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/run /var/lib/chrony -/var/log
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=yes
|
|
RestrictSUIDSGID=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallFilter=~@cpu-emulation @debug @module @mount @obsolete @raw-io @reboot @swap
|
|
|
|
# Adjust restrictions for /usr/sbin/sendmail (mailonchange directive)
|
|
NoNewPrivileges=no
|
|
ReadWritePaths=-/var/spool
|
|
RestrictAddressFamilies=AF_NETLINK
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|