Mirrors_Framework/mosquitto
1
0
Fork 0
mirror of https://github.com/eclipse-mosquitto/mosquitto.git synced 2026-02-06 02:52:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Let systemd create directories

Browse Source 
Manually creating directories conflicts with systemd service hardening
features. Particularly, `ProtectSystem=strict` mounts the filesystem as
read-only for the processes started by the unit which leads to `mkdir`
failing.

By setting `User=mosquitto` and adding `RuntimeDirectory` and
`LogsDirectory`, systemd creates `/run/mosquitto` and
`/var/log/mosquitto` with the right permissions even
`ProtectSystem=strict` is used.

Signed-off-by: Guillaume Champagne <champagne.guillaume.c@gmail.com>
This commit is contained in:
Guillaume Champagne
2024-10-04 15:45:53 -04:00
committed by Roger Light
parent a3a70d320d
commit f529623b38
2 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
service/systemd/mosquitto.service.notify
View File

@@ -5,16 +5,15 @@ After=network.target
Wants=network.target
[Service]
User=mosquitto
Type=notify
WatchdogSec=3min
NotifyAccess=main
ExecStart=/usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
ExecStartPre=/bin/mkdir -m 740 -p /var/log/mosquitto
ExecStartPre=/bin/chown mosquitto:mosquitto /var/log/mosquitto
ExecStartPre=/bin/mkdir -m 740 -p /run/mosquitto
ExecStartPre=/bin/chown mosquitto:mosquitto /run/mosquitto
RuntimeDirectory=mosquitto
LogsDirectory=mosquitto
[Install]
WantedBy=multi-user.target

7
service/systemd/mosquitto.service.simple
View File

@@ -5,13 +5,12 @@ After=network.target
Wants=network.target
[Service]
User=mosquitto
ExecStart=/usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
ExecStartPre=/bin/mkdir -m 740 -p /var/log/mosquitto
ExecStartPre=/bin/chown mosquitto:mosquitto /var/log/mosquitto
ExecStartPre=/bin/mkdir -m 740 -p /run/mosquitto
ExecStartPre=/bin/chown mosquitto:mosquitto /run/mosquitto
RuntimeDirectory=mosquitto
LogsDirectory=mosquitto
[Install]
WantedBy=multi-user.target