Merge pull request #149 from kerolasa/unit-files

Add  systemd rarpd and ninfod unit files

6 files changed, 92 insertions, 7 deletions

diff --git a/configure b/configure
index 9a1413b..889c507 100755
--- a/configure
+++ b/configure
@@ -4,7 +4,7 @@ if [ $# -ne 0 ]; then
 	meson configure builddir
 	echo ''
 	echo 'Configuration can be changed like this:'
-	echo '  meson configure builddir -DBUILD_NINFOD=true'
+	echo '  meson configure builddir -Dprefix=/usr'
 	echo '  More info: http://mesonbuild.com/Configuring-a-build-directory.html'
 	# See also: http://mesonbuild.com/howtox.html
 fi
diff --git a/meson.build b/meson.build
index 7dcf65d..2943fb9 100644
--- a/meson.build
+++ b/meson.build
@@ -90,6 +90,12 @@ elif opt == 'none'
 	conf.set('PING6_NONCE_MEMORY', 1, description : 'If set RFC6744 random does not use any CRYPTO lib.')
 endif
 
+systemd = dependency('systemd', required : false)
+systemdunitdir = get_option('systemdunitdir')
+if systemdunitdir == '' and systemd.found()
+	systemdunitdir = systemd.get_pkgconfig_variable('systemdsystemunitdir')
+endif
+
 build_arping = get_option('BUILD_ARPING')
 build_clockdiff = get_option('BUILD_CLOCKDIFF')
 build_ping = get_option('BUILD_PING')
@@ -218,7 +224,18 @@ endif
 
 if build_rarpd == true
 	executable('rarpd', ['rarpd.c', git_version_h],
+		install_dir: 'sbin',
 		install: true)
+	if systemd.found()
+		subs = configuration_data()
+		subs.set('sbindir', join_paths(get_option('prefix'), get_option('sbindir')))
+		unit_file = configure_file(
+			input: 'systemd/rarpd.service.in',
+			output: 'rarpd@.service',
+			configuration: subs
+		)
+		install_data(unit_file, install_dir: systemdunitdir)
+	endif
 endif
 
 if build_ninfod == true
diff --git a/meson_options.txt b/meson_options.txt
index 8cfc8ad..c825156 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -34,7 +34,7 @@ option('BUILD_TRACEPATH', type : 'boolean', value : true,
 option('BUILD_TRACEROUTE6', type : 'boolean', value : true,
         description : 'Build traceroute6')
 
-option('BUILD_NINFOD', type : 'boolean', value : false,
+option('BUILD_NINFOD', type : 'boolean', value : true,
 	description : 'Build ninfod')
 
 option('BUILD_MANS', type : 'boolean', value : true,
@@ -48,3 +48,6 @@ option('ARPING_DEFAULT_DEVICE', type : 'string', value : '',
 
 option('USE_SYSFS', type : 'boolean', value : true,
 	description : 'Use /sys file system (arping)')
+
+option('systemdunitdir', type: 'string', value: '',
+	description: 'Directory for systemd units')
diff --git a/ninfod/meson.build b/ninfod/meson.build
index fc5ede4..4e3cfd9 100644
--- a/ninfod/meson.build
+++ b/ninfod/meson.build
@@ -16,8 +16,20 @@ executable('ninfod', [ninfod_sources, git_version_h],
 	install_dir: 'sbin')
 conf_data = configuration_data()
 conf_data.set('prefix', get_option('prefix'))
-configure_file(input : 'ninfod.sh.in',
-	output : 'ninfod.sh',
-	configuration : conf_data,
-	install : true,
-	install_dir : join_paths(get_option('sysconfdir'), 'init.d'))
+
+if systemd.found()
+	subs = configuration_data()
+	subs.set('sbindir', join_paths(get_option('prefix'), get_option('sbindir')))
+	unit_file = configure_file(
+		input: '../systemd/ninfod.service.in',
+		output: 'ninfod.service',
+		configuration: subs
+	)
+	install_data(unit_file, install_dir: systemdunitdir)
+else
+	configure_file(input : 'ninfod.sh.in',
+		output : 'ninfod.sh',
+		configuration : conf_data,
+		install : true,
+		install_dir : join_paths(get_option('sysconfdir'), 'init.d'))
+endif
diff --git a/systemd/ninfod.service.in b/systemd/ninfod.service.in
new file mode 100644
index 0000000..5ab69ca
--- /dev/null
+++ b/systemd/ninfod.service.in
@@ -0,0 +1,26 @@
+[Unit]
+Description=Respond to IPv6 Node Information Queries
+Documentation=ninfod(8)
+Requires=network.target
+After=network.target
+
+[Service]
+ExecStart=@sbindir@/ninfod -d
+
+AmbientCapabilities=CAP_NET_RAW
+DynamicUser=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectControlGroups=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+MemoryDenyWriteExecute=yes
+RestrictRealtime=yes
+RestrictNamespaces=yes
+SystemCallArchitectures=native
+LockPersonality=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/systemd/rarpd.service.in b/systemd/rarpd.service.in
new file mode 100644
index 0000000..d161785
--- /dev/null
+++ b/systemd/rarpd.service.in
@@ -0,0 +1,27 @@
+[Unit]
+Description=Reverse Address Resolution Protocol Requests Server (%I)
+Documentation=man:rarpd(8)
+Requires=network.target
+After=network.target
+
+[Service]
+EnvironmentFile=-/etc/sysconfig/rarpd
+ExecStart=@sbindir@/rarpd -d $OPTIONS %i
+
+PrivateTmp=yes
+PrivateDevices=yes
+PrivateUsers=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectControlGroups=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+MemoryDenyWriteExecute=yes
+RestrictRealtime=yes
+RestrictNamespaces=yes
+SystemCallArchitectures=native
+LockPersonality=yes
+NoNewPrivileges=yes
+
+[Install]
+WantedBy=multi-user.target