summaryrefslogtreecommitdiff
path: root/tmpfiles.d
diff options
context:
space:
mode:
authorZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2013-12-20 20:25:39 -0500
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2013-12-24 15:48:06 -0500
commitc4708f132381e4bbc864d5241381b5cde4f54878 (patch)
tree1802c55a1aa92e3855748a0e6463ee6020f0286c /tmpfiles.d
parentef72c1f06e2bc696a799cd31a1e0ed25cc999ea4 (diff)
downloadsystemd-c4708f132381e4bbc864d5241381b5cde4f54878.tar.gz
tmpfiles: introduce the concept of unsafe operations
Various operations done by systemd-tmpfiles may only be safely done at boot (e.g. removal of X lockfiles in /tmp, creation of /run/nologin). Other operations may be done at any point in time (e.g. setting the ownership on /{run,var}/log/journal). This distinction is largely orthogonal to the type of operation. A new switch --unsafe is added, and operations which should only be executed during bootup are marked with an exclamation mark in the configuration files. systemd-tmpfiles.service is modified to use this switch, and guards are added so it is hard to re-start it by mistake. If we install a new version of systemd, we actually want to enforce some changes to tmpfiles configuration immediately. This should now be possible to do safely, so distribution packages can be modified to execute the "safe" subset at package installation time. /run/nologin creation is split out into a separate service, to make it easy to override. https://bugzilla.redhat.com/show_bug.cgi?id=1043212 https://bugzilla.redhat.com/show_bug.cgi?id=1045849
Diffstat (limited to 'tmpfiles.d')
-rw-r--r--tmpfiles.d/legacy.conf6
-rw-r--r--tmpfiles.d/systemd-nologin.conf11
-rw-r--r--tmpfiles.d/systemd.conf4
-rw-r--r--tmpfiles.d/x11.conf2
4 files changed, 16 insertions, 7 deletions
diff --git a/tmpfiles.d/legacy.conf b/tmpfiles.d/legacy.conf
index 3fff347db4..a1656873da 100644
--- a/tmpfiles.d/legacy.conf
+++ b/tmpfiles.d/legacy.conf
@@ -29,6 +29,6 @@ d /run/lock/lockdev 0775 root lock -
# kernel command line options 'fsck.mode=force', 'fsck.mode=skip' and
# 'quotacheck.mode=force'
-r /forcefsck
-r /fastboot
-r /forcequotacheck
+r! /forcefsck
+r! /fastboot
+r! /forcequotacheck
diff --git a/tmpfiles.d/systemd-nologin.conf b/tmpfiles.d/systemd-nologin.conf
new file mode 100644
index 0000000000..d61232b534
--- /dev/null
+++ b/tmpfiles.d/systemd-nologin.conf
@@ -0,0 +1,11 @@
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+
+# See tmpfiles.d(5) and systemd-forbid-user-logins.service(5).
+# This file has special suffix so it is not run by mistake.
+
+F! /run/nologin 0644 - - - "System is booting up. See pam_nologin(8)"
diff --git a/tmpfiles.d/systemd.conf b/tmpfiles.d/systemd.conf
index a05c6577d2..7c6d6b9099 100644
--- a/tmpfiles.d/systemd.conf
+++ b/tmpfiles.d/systemd.conf
@@ -8,7 +8,7 @@
# See tmpfiles.d(5) for details
d /run/user 0755 root root ~10d
-F /run/utmp 0664 root utmp -
+F! /run/utmp 0664 root utmp -
f /var/log/wtmp 0664 root utmp -
f /var/log/btmp 0600 root utmp -
@@ -22,8 +22,6 @@ d /run/systemd/users 0755 root root -
d /run/systemd/machines 0755 root root -
d /run/systemd/shutdown 0755 root root -
-F /run/nologin 0644 - - - "System is booting up. See pam_nologin(8)"
-
m /var/log/journal 2755 root systemd-journal - -
m /var/log/journal/%m 2755 root systemd-journal - -
m /run/log/journal 2755 root systemd-journal - -
diff --git a/tmpfiles.d/x11.conf b/tmpfiles.d/x11.conf
index ece6a5ce98..4c96a54a13 100644
--- a/tmpfiles.d/x11.conf
+++ b/tmpfiles.d/x11.conf
@@ -15,4 +15,4 @@ d /tmp/.font-unix 1777 root root 10d
d /tmp/.Test-unix 1777 root root 10d
# Unlink the X11 lock files
-r /tmp/.X[0-9]*-lock
+r! /tmp/.X[0-9]*-lock