Closed candrews closed 8 years ago
Yes! I've been wanting to do this for a while. This info is going to make it easier. Thanks!
Expect radvd 2.14 to have this in the next week or so.
On Fri, Jul 1, 2016 at 11:27 AM, Craig Andrews notifications@github.com wrote:
Can radvd please include and (optionally) install a systemd service?
Many distros are using systemd (such as Debian, Ubuntu, and Fedora) and others are supporting but not necessarily using it by default (Gentoo). Currently, each one of these distributions has to create and distribute their own systemd service for radvd, even though they're all (virtually) identical, with the only differences being inadvertent or unnecessary. One of the goals of systemd is "to unify the boot and service management between distributions with systemd." http://0pointer.de/blog/projects/systemd-update.html I think everyone agrees that it's bad if every distribution patched the radvd source... so this situation is also less than ideal. Besides making life easier for distributions and users, upstreaming a systemd service also helps radvd out in another way - it makes things more consistent, which eases maintainability.
Here's the systemd unit I propose, using what's in Gentoo https://github.com/gentoo/gentoo/blob/fed779d199e5f0718550194518d85a1567c55767/net-misc/radvd/files/radvd.service and Fedora http://pkgs.fedoraproject.org/cgit/rpms/radvd.git/tree/radvd.service as a baseline:
[Unit] Description=Router advertisement daemon for IPv6 Documentation=man:radvd(8) After=network.target
[Service] User=radvd Group=radvd Type=forking ExecStartPre=/usr/sbin/radvd --configtest ExecStart=/usr/sbin/radvd --logmethod stderr --debug 0 ExecReload=/usr/sbin/radvd --configtest ; \ /bin/kill -HUP $MAINPID CPUSchedulingPolicy=idle PIDFile=/run/radvd/radvd.pid RuntimeDirectory=radvd CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_RAW AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW PrivateTmp=yes PrivateDevices=yes ProtectSystem=full ProtectHome=yes NoNewPrivileges=yes
[Install] WantedBy=multi-user.target
The de facto way to handle systemd unit is with the flags --without-systemduserunitdir (which doesn't install the unit) and --with-systemduserunitdir=[path](which installs the unit to the given path).
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/reubenhwk/radvd/issues/56, or mute the thread https://github.com/notifications/unsubscribe/AAMTe6u3mhgtVuIJUN94PW89YuBi9zrvks5qRVwbgaJpZM4JDYMD .
question,
Wouldn't ExecReload do better like this...
ExecReload=/usr/sbin/radvd --configtest && /bin/kill -HUP $MAINPID
On Sat, Jul 2, 2016 at 11:17 AM, Reuben Hawkins reubenhwk@gmail.com wrote:
Yes! I've been wanting to do this for a while. This info is going to make it easier. Thanks!
Expect radvd 2.14 to have this in the next week or so.
On Fri, Jul 1, 2016 at 11:27 AM, Craig Andrews notifications@github.com wrote:
Can radvd please include and (optionally) install a systemd service?
Many distros are using systemd (such as Debian, Ubuntu, and Fedora) and others are supporting but not necessarily using it by default (Gentoo). Currently, each one of these distributions has to create and distribute their own systemd service for radvd, even though they're all (virtually) identical, with the only differences being inadvertent or unnecessary. One of the goals of systemd is "to unify the boot and service management between distributions with systemd." http://0pointer.de/blog/projects/systemd-update.html I think everyone agrees that it's bad if every distribution patched the radvd source... so this situation is also less than ideal. Besides making life easier for distributions and users, upstreaming a systemd service also helps radvd out in another way - it makes things more consistent, which eases maintainability.
Here's the systemd unit I propose, using what's in Gentoo https://github.com/gentoo/gentoo/blob/fed779d199e5f0718550194518d85a1567c55767/net-misc/radvd/files/radvd.service and Fedora http://pkgs.fedoraproject.org/cgit/rpms/radvd.git/tree/radvd.service as a baseline:
[Unit] Description=Router advertisement daemon for IPv6 Documentation=man:radvd(8) After=network.target
[Service] User=radvd Group=radvd Type=forking ExecStartPre=/usr/sbin/radvd --configtest ExecStart=/usr/sbin/radvd --logmethod stderr --debug 0 ExecReload=/usr/sbin/radvd --configtest ; \ /bin/kill -HUP $MAINPID CPUSchedulingPolicy=idle PIDFile=/run/radvd/radvd.pid RuntimeDirectory=radvd CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_RAW AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW PrivateTmp=yes PrivateDevices=yes ProtectSystem=full ProtectHome=yes NoNewPrivileges=yes
[Install] WantedBy=multi-user.target
The de facto way to handle systemd unit is with the flags --without-systemduserunitdir (which doesn't install the unit) and --with-systemduserunitdir=[path](which installs the unit to the given path).
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/reubenhwk/radvd/issues/56, or mute the thread https://github.com/notifications/unsubscribe/AAMTe6u3mhgtVuIJUN94PW89YuBi9zrvks5qRVwbgaJpZM4JDYMD .
Wow, yeah. That does seem better!
Another question...
who uses --with-systemduserunitdir? Is there a standard m4 macro for this yet?
On Sat, Jul 2, 2016 at 11:38 AM, Craig Andrews notifications@github.com wrote:
Wow, yeah. That does seem better!
— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/reubenhwk/radvd/issues/56#issuecomment-230116010, or mute the thread https://github.com/notifications/unsubscribe/AAMTeyVvZUXuBm1rn2cd9AJBUGOrdfeDks5qRrA9gaJpZM4JDYMD .
Nevermind... I think I found the useful info here...
https://www.freedesktop.org/software/systemd/man/daemon.html
On Sun, Jul 3, 2016 at 8:47 AM, Reuben Hawkins reubenhwk@gmail.com wrote:
Another question...
who uses --with-systemduserunitdir? Is there a standard m4 macro for this yet?
On Sat, Jul 2, 2016 at 11:38 AM, Craig Andrews notifications@github.com wrote:
Wow, yeah. That does seem better!
— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/reubenhwk/radvd/issues/56#issuecomment-230116010, or mute the thread https://github.com/notifications/unsubscribe/AAMTeyVvZUXuBm1rn2cd9AJBUGOrdfeDks5qRrA9gaJpZM4JDYMD .
Hi Craig,
Can you checkout the radvd/systemd branch and give it a go? Let me know if the changes work.
Thanks in advance, Reuben
On Sun, Jul 3, 2016 at 8:50 AM, Reuben Hawkins reubenhwk@gmail.com wrote:
Nevermind... I think I found the useful info here...
https://www.freedesktop.org/software/systemd/man/daemon.html
On Sun, Jul 3, 2016 at 8:47 AM, Reuben Hawkins reubenhwk@gmail.com wrote:
Another question...
who uses --with-systemduserunitdir? Is there a standard m4 macro for this yet?
On Sat, Jul 2, 2016 at 11:38 AM, Craig Andrews notifications@github.com wrote:
Wow, yeah. That does seem better!
— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/reubenhwk/radvd/issues/56#issuecomment-230116010, or mute the thread https://github.com/notifications/unsubscribe/AAMTeyVvZUXuBm1rn2cd9AJBUGOrdfeDks5qRrA9gaJpZM4JDYMD .
https://github.com/reubenhwk/radvd/blob/87e35be85ef56e28a59b68bd01ec8eaa96acbfef/radvd.service.in is missing the hardening features - perhaps those could be added in? I submitted a PR to your branch: https://github.com/reubenhwk/radvd/pull/58
Distros (including Gentoo and Fedora) run radvd as the "radvd" user (which is nice as it reduces the privileges more) - would it make sense to add "--username radvd" to ExecStart and add "CAP_SETUID CAP_SETGID" to the CapabilityBoundingSet?
I think that may mean the readme and/or installation instructions... But it would be nice as then distros could use the upstream service unmodified.
Not sure it's necessary. RADVD forks off a unprivileged process to do all the work which runs as nobody. The privileged process still runs as root. Is it worth the effort? Should both processes run as the runas user, or just the privileged one?
Sent from my iPhone
On Aug 8, 2016, at 5:42 PM, Craig Andrews notifications@github.com wrote:
Distros (including Gentoo and Fedora) run radvd as the "radvd" user (which is nice as it reduces the privileges more) - would it make sense to add "--username radvd" to ExecStart and add "CAP_SETUID CAP_SETGID" to the CapabilityBoundingSet?
I think that may mean the readme and/or installation instructions... But it would be nice as then distros could use the upstream service unmodified.
— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.
systemd service file is now included
Can radvd please include and (optionally) install a systemd service?
Many distros are using systemd (such as Debian, Ubuntu, and Fedora) and others are supporting but not necessarily using it by default (Gentoo). Currently, each one of these distributions has to create and distribute their own systemd service for radvd, even though they're all (virtually) identical, with the only differences being inadvertent or unnecessary. One of the goals of systemd is "to unify the boot and service management between distributions with systemd." I think everyone agrees that it's bad if every distribution patched the radvd source... so this situation is also less than ideal. Besides making life easier for distributions and users, upstreaming a systemd service also helps radvd out in another way - it makes things more consistent, which eases maintainability.
Here's the systemd unit I propose, using what's in Gentoo and Fedora as a baseline:
The de facto way to handle systemd unit is with the flags
--without-systemduserunitdir
(which doesn't install the unit) and--with-systemduserunitdir=[path]
(which installs the unit to the given path).