Gentoo Archives: gentoo-dev

From: Florian Schmaus <flow@g.o>
To: gentoo-dev@l.g.o
Subject: Re: [gentoo-dev] [RFC] Encouraging using hardening options in systemd units
Date: Fri, 26 Aug 2022 08:57:41
Message-Id: 9965526e-3fcc-3cde-f0c8-9a872094212a@gentoo.org
In Reply to: Re: [gentoo-dev] [RFC] Encouraging using hardening options in systemd units by "Michał Górny"
1 On 25/08/2022 17.03, Michał Górny wrote:
2 > On Thu, 2022-08-25 at 16:06 +0200, Florian Schmaus wrote:
3 >> On 25/08/2022 15.25, Kenton Groombridge wrote:
4 >>> I think the best way to address this is to have packages ship unit override
5 >>> files instead of unit files themselves which enable these options. For example,
6 >>> instead of Gentoo shipping a modified miniflux.service unit file, we can instead
7 >>> install a file to /etc/system/miniflux.service.d/00gentoo.conf using the
8 >>> existing systemd_install_serviced helper in systemd.eclass which enables these
9 >>> options.
10 >>
11 >> Wouldn't the proper place for overrides installed by a distributions
12 >> package manager be
13 >>
14 >> /usr/lib/systemd/system/miniflux.service.d/gentoo.conf
15 >
16 > These files are meant to be modifiable by the sysadmin, so they don't
17 > belong in /usr.
18
19 While then can not be modified, settings made in /usr/lib/systemd/system
20 can be overridden by the sysadmin by placing a file in /etc/systemd/system.
21
22 I am not aware of a reason why a package manger should install systemd
23 configuration files under /etc.
24
25 - Flow

Replies