-
-
Notifications
You must be signed in to change notification settings - Fork 492
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Feature Request] [Enhancement] Systemd service file #1018
Comments
|
@TriMoon Thanks for your attention to detail. I've not yet had a chance to test this personally but these are good ideas. |
You can try the PR, linked above, locally and see if you like it 😉 |
The version under your merge request did work without modification but here is my critique:
The present state of Makefile relies upon the OS/user umask for directory permissions during creation or packaging of /etc/opensnitch/rules, for this reason, hard coding
There is a benign warning if The introduction of the custom_config variable may be unnecessary unless use of I'm presently using a modified version incorporating these items. This version produces no systemd warnings under my up-to-date Archlinux system(s):
Typically the trends set by this project aim for general compatibility and my basic investigation and minimal testing suggest that it will be generally compatible. Nice work, thanks! One additional note, many of these concepts may be applicable to the UI component. Someday I'd like to try implementing UI control via systemd unless someone beats me to it! |
@lainedfles please see #1019 and use that in future to suggest changes 😉 |
Summary:
The systemd service unit can be enhanced to start BEFORE any network is configured, and thus allow interception and protection at an earlier stage...
Service file:
Below is my crafted service file:
Notable changes/additions:
Unit filename:
⚠️ The service filename was changed to
opensnitchd.service
!!!This was needed for automatically using the unit name in the service definition using the
%N
specifier...See: Specifiers@man
systemd.unit#Specifiers
d
in it's name !Unit ordering:
Made sure the daemon starts before any network related devices or services are created/started by using
network-pre.target
, See:Startup target / run-level:
Changed the default install target to
basic.target
instead ofmulti-user.target
.This will allow it to run in any "run-level" in SysV terms.
See: Units managed by the system service manager@man
systemd.special#basic.target
Automatically disable using a kernel-command-line option:
Just in case it is needed, i added the ability to disable the daemon using a kernel-command-line option using the
ConditionKernelCommandLine
directive.When the
no-appfw
option is present in the kernel-command-line, the daemon will not startup.This option functions same as the well-known
quite
option. (only applies when present as a separate word)Automatically create rules directory:
Let systemd automatically create the "rules" directory with proper mode, when non-existent yet, upon starting the daemon service by using the
ConfigurationDirectory
andConfigurationDirectoryMode
directives.Automatically check for kernel support before starting:
Automatically prevent startup when required kernel support is not present by using the
-check-requirements
flag in aExecCondition
directive.(This assumes the command returns a non-zero exit status when not satisfied.)
Reload functionality:
Added support for reloading the daemon using the
ExecReload
directive.Signal-info was taken from the init.d script, but it just exits and then systemd restarts the service...
So this functionality either needs to be implemented in the daemon's code or a different signal needs to be sent to it.
But at least the functionality is now present in the unit file.
Prevent from being killed by the OOM-Killer:
Prevented the daemon to be killed by the Linux kernel's Out-Of-Memory (OOM) killer, using the
OOMScoreAdjust=-1000
directive.See: OOMScoreAdjust@man
systemd.exec#OOMScoreAdjust
(This will ensure that the protection keeps functioning even when other processes cause an OOM)
Admin overrides using drop-ins:
Added support for easily adjusting the directory used for rules and extra options by the local admin.
The local admin can create "drop-in" config(s) under
/etc/systemd/system/opensnitchd.service.d/
even when the service file is installed in other places by the package maintainer, See: 16.14. Extending the default unit configuration@redhat.comExample drop-in(s) contents that can-be-used:
To change the rules directory to be used:
$custom_cfg
is supplied as an argument to the-rules-path
option of the daemon.systemd.unit#Specifiers
%E
expands to/etc
%N
expands to the unit nameopensnitchd
/etc/opensnitchd/rules-special
To enable debug output:
$opts
is supplied as extra argument(s) to the daemon.Combination of both:
One last thing to improve systemd usage:
Please add a way to prevent timestamps being output at all, when using
/dev/stdout
as log destination.Or at least add a
syslog
option to use as logger, which also doesn't need timestamps because it adds them self.Look how ugly it is at moment:
The text was updated successfully, but these errors were encountered: