radvd-project / radvd

radvd | Official repository: https://github.com/radvd-project/radvd
https://radvd.litech.org/
Other
203 stars 107 forks source link

Include a systemd service #56

Closed candrews closed 8 years ago

candrews commented 8 years ago

Can radvd please include and (optionally) install a systemd service?

Many distros are using systemd (such as Debian, Ubuntu, and Fedora) and others are supporting but not necessarily using it by default (Gentoo). Currently, each one of these distributions has to create and distribute their own systemd service for radvd, even though they're all (virtually) identical, with the only differences being inadvertent or unnecessary. One of the goals of systemd is "to unify the boot and service management between distributions with systemd." I think everyone agrees that it's bad if every distribution patched the radvd source... so this situation is also less than ideal. Besides making life easier for distributions and users, upstreaming a systemd service also helps radvd out in another way - it makes things more consistent, which eases maintainability.

Here's the systemd unit I propose, using what's in Gentoo and Fedora as a baseline:

[Unit]
Description=Router advertisement daemon for IPv6
Documentation=man:radvd(8)
After=network.target

[Service]
User=radvd
Group=radvd
Type=forking
ExecStartPre=/usr/sbin/radvd --configtest
ExecStart=/usr/sbin/radvd --logmethod stderr --debug 0
ExecReload=/usr/sbin/radvd --configtest ; \
           /bin/kill -HUP $MAINPID
CPUSchedulingPolicy=idle
PIDFile=/run/radvd/radvd.pid
RuntimeDirectory=radvd
CapabilityBoundingSet=CAP_NET_BIND_SERVICE  CAP_NET_RAW
AmbientCapabilities=CAP_NET_BIND_SERVICE  CAP_NET_RAW
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=full
ProtectHome=yes
NoNewPrivileges=yes

[Install]
WantedBy=multi-user.target

The de facto way to handle systemd unit is with the flags --without-systemduserunitdir (which doesn't install the unit) and --with-systemduserunitdir=[path] (which installs the unit to the given path).

reubenhwk commented 8 years ago

Yes! I've been wanting to do this for a while. This info is going to make it easier. Thanks!

Expect radvd 2.14 to have this in the next week or so.

On Fri, Jul 1, 2016 at 11:27 AM, Craig Andrews notifications@github.com wrote:

Can radvd please include and (optionally) install a systemd service?

Many distros are using systemd (such as Debian, Ubuntu, and Fedora) and others are supporting but not necessarily using it by default (Gentoo). Currently, each one of these distributions has to create and distribute their own systemd service for radvd, even though they're all (virtually) identical, with the only differences being inadvertent or unnecessary. One of the goals of systemd is "to unify the boot and service management between distributions with systemd." http://0pointer.de/blog/projects/systemd-update.html I think everyone agrees that it's bad if every distribution patched the radvd source... so this situation is also less than ideal. Besides making life easier for distributions and users, upstreaming a systemd service also helps radvd out in another way - it makes things more consistent, which eases maintainability.

Here's the systemd unit I propose, using what's in Gentoo https://github.com/gentoo/gentoo/blob/fed779d199e5f0718550194518d85a1567c55767/net-misc/radvd/files/radvd.service and Fedora http://pkgs.fedoraproject.org/cgit/rpms/radvd.git/tree/radvd.service as a baseline:

[Unit] Description=Router advertisement daemon for IPv6 Documentation=man:radvd(8) After=network.target

[Service] User=radvd Group=radvd Type=forking ExecStartPre=/usr/sbin/radvd --configtest ExecStart=/usr/sbin/radvd --logmethod stderr --debug 0 ExecReload=/usr/sbin/radvd --configtest ; \ /bin/kill -HUP $MAINPID CPUSchedulingPolicy=idle PIDFile=/run/radvd/radvd.pid RuntimeDirectory=radvd CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_RAW AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW PrivateTmp=yes PrivateDevices=yes ProtectSystem=full ProtectHome=yes NoNewPrivileges=yes

[Install] WantedBy=multi-user.target

The de facto way to handle systemd unit is with the flags --without-systemduserunitdir (which doesn't install the unit) and --with-systemduserunitdir=[path](which installs the unit to the given path).

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/reubenhwk/radvd/issues/56, or mute the thread https://github.com/notifications/unsubscribe/AAMTe6u3mhgtVuIJUN94PW89YuBi9zrvks5qRVwbgaJpZM4JDYMD .

reubenhwk commented 8 years ago

question,

Wouldn't ExecReload do better like this...

ExecReload=/usr/sbin/radvd --configtest && /bin/kill -HUP $MAINPID

On Sat, Jul 2, 2016 at 11:17 AM, Reuben Hawkins reubenhwk@gmail.com wrote:

Yes! I've been wanting to do this for a while. This info is going to make it easier. Thanks!

Expect radvd 2.14 to have this in the next week or so.

On Fri, Jul 1, 2016 at 11:27 AM, Craig Andrews notifications@github.com wrote:

Can radvd please include and (optionally) install a systemd service?

Many distros are using systemd (such as Debian, Ubuntu, and Fedora) and others are supporting but not necessarily using it by default (Gentoo). Currently, each one of these distributions has to create and distribute their own systemd service for radvd, even though they're all (virtually) identical, with the only differences being inadvertent or unnecessary. One of the goals of systemd is "to unify the boot and service management between distributions with systemd." http://0pointer.de/blog/projects/systemd-update.html I think everyone agrees that it's bad if every distribution patched the radvd source... so this situation is also less than ideal. Besides making life easier for distributions and users, upstreaming a systemd service also helps radvd out in another way - it makes things more consistent, which eases maintainability.

Here's the systemd unit I propose, using what's in Gentoo https://github.com/gentoo/gentoo/blob/fed779d199e5f0718550194518d85a1567c55767/net-misc/radvd/files/radvd.service and Fedora http://pkgs.fedoraproject.org/cgit/rpms/radvd.git/tree/radvd.service as a baseline:

[Unit] Description=Router advertisement daemon for IPv6 Documentation=man:radvd(8) After=network.target

[Service] User=radvd Group=radvd Type=forking ExecStartPre=/usr/sbin/radvd --configtest ExecStart=/usr/sbin/radvd --logmethod stderr --debug 0 ExecReload=/usr/sbin/radvd --configtest ; \ /bin/kill -HUP $MAINPID CPUSchedulingPolicy=idle PIDFile=/run/radvd/radvd.pid RuntimeDirectory=radvd CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_RAW AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW PrivateTmp=yes PrivateDevices=yes ProtectSystem=full ProtectHome=yes NoNewPrivileges=yes

[Install] WantedBy=multi-user.target

The de facto way to handle systemd unit is with the flags --without-systemduserunitdir (which doesn't install the unit) and --with-systemduserunitdir=[path](which installs the unit to the given path).

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/reubenhwk/radvd/issues/56, or mute the thread https://github.com/notifications/unsubscribe/AAMTe6u3mhgtVuIJUN94PW89YuBi9zrvks5qRVwbgaJpZM4JDYMD .

candrews commented 8 years ago

Wow, yeah. That does seem better!

reubenhwk commented 8 years ago

Another question...

who uses --with-systemduserunitdir? Is there a standard m4 macro for this yet?

On Sat, Jul 2, 2016 at 11:38 AM, Craig Andrews notifications@github.com wrote:

Wow, yeah. That does seem better!

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/reubenhwk/radvd/issues/56#issuecomment-230116010, or mute the thread https://github.com/notifications/unsubscribe/AAMTeyVvZUXuBm1rn2cd9AJBUGOrdfeDks5qRrA9gaJpZM4JDYMD .

reubenhwk commented 8 years ago

Nevermind... I think I found the useful info here...

https://www.freedesktop.org/software/systemd/man/daemon.html

On Sun, Jul 3, 2016 at 8:47 AM, Reuben Hawkins reubenhwk@gmail.com wrote:

Another question...

who uses --with-systemduserunitdir? Is there a standard m4 macro for this yet?

On Sat, Jul 2, 2016 at 11:38 AM, Craig Andrews notifications@github.com wrote:

Wow, yeah. That does seem better!

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/reubenhwk/radvd/issues/56#issuecomment-230116010, or mute the thread https://github.com/notifications/unsubscribe/AAMTeyVvZUXuBm1rn2cd9AJBUGOrdfeDks5qRrA9gaJpZM4JDYMD .

reubenhwk commented 8 years ago

Hi Craig,

Can you checkout the radvd/systemd branch and give it a go? Let me know if the changes work.

Thanks in advance, Reuben

On Sun, Jul 3, 2016 at 8:50 AM, Reuben Hawkins reubenhwk@gmail.com wrote:

Nevermind... I think I found the useful info here...

https://www.freedesktop.org/software/systemd/man/daemon.html

On Sun, Jul 3, 2016 at 8:47 AM, Reuben Hawkins reubenhwk@gmail.com wrote:

Another question...

who uses --with-systemduserunitdir? Is there a standard m4 macro for this yet?

On Sat, Jul 2, 2016 at 11:38 AM, Craig Andrews notifications@github.com wrote:

Wow, yeah. That does seem better!

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/reubenhwk/radvd/issues/56#issuecomment-230116010, or mute the thread https://github.com/notifications/unsubscribe/AAMTeyVvZUXuBm1rn2cd9AJBUGOrdfeDks5qRrA9gaJpZM4JDYMD .

candrews commented 8 years ago

https://github.com/reubenhwk/radvd/blob/87e35be85ef56e28a59b68bd01ec8eaa96acbfef/radvd.service.in is missing the hardening features - perhaps those could be added in? I submitted a PR to your branch: https://github.com/reubenhwk/radvd/pull/58

candrews commented 8 years ago

Distros (including Gentoo and Fedora) run radvd as the "radvd" user (which is nice as it reduces the privileges more) - would it make sense to add "--username radvd" to ExecStart and add "CAP_SETUID CAP_SETGID" to the CapabilityBoundingSet?

I think that may mean the readme and/or installation instructions... But it would be nice as then distros could use the upstream service unmodified.

reubenhwk commented 8 years ago

Not sure it's necessary. RADVD forks off a unprivileged process to do all the work which runs as nobody. The privileged process still runs as root. Is it worth the effort? Should both processes run as the runas user, or just the privileged one?

Sent from my iPhone

On Aug 8, 2016, at 5:42 PM, Craig Andrews notifications@github.com wrote:

Distros (including Gentoo and Fedora) run radvd as the "radvd" user (which is nice as it reduces the privileges more) - would it make sense to add "--username radvd" to ExecStart and add "CAP_SETUID CAP_SETGID" to the CapabilityBoundingSet?

I think that may mean the readme and/or installation instructions... But it would be nice as then distros could use the upstream service unmodified.

— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

reubenhwk commented 8 years ago

systemd service file is now included