public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/confinement: Remove handling for StartOnly

Browse Source 
Noted by @Infinisil on IRC:

   infinisil: Question regarding the confinement PR
   infinisil: On line 136 you do different things depending on
              RootDirectoryStartOnly
   infinisil: But on line 157 you have an assertion that disallows that
              option being true
   infinisil: Is there a reason behind this or am I missing something

I originally left this in so that once systemd supports that, we can
just flip a switch and remove the assertion and thus support
RootDirectoryStartOnly for our confinement module.

However, this doesn't seem to be on the roadmap for systemd in the
foreseeable future, so I'll just remove this, especially because it's
very easy to add it again, once it is supported.

Signed-off-by: aszlig <aszlig@nix.build>
This commit is contained in:
aszlig 2019-03-27 20:16:44 +01:00
parent d13ad389b4
commit 861a1cec60
No known key found for this signature in database
GPG Key ID: 684089CE67EBB691
1 changed files with 2 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
nixos/modules/security/systemd-confinement.nix
View File

@ -52,11 +52,7 @@ in {
dependencies of this systemd unit, you can use
<option>confinement.fullUnit</option>.
<note><para><emphasis role="strong">Only</emphasis> the latter
(${mkScOption "ExecStart"}) will be used if
${mkScOption "RootDirectoryStartOnly"} is enabled.</para></note>
<note><para>Also, the store paths listed in <option>path</option> are
<note><para>The store paths listed in <option>path</option> are
<emphasis role="strong">not</emphasis> included in the closure as
well as paths from other options except those listed
above.</para></note>
@ -133,8 +129,7 @@ in {
ProtectKernelTunables = wantsAPIVFS;
};
confinement.packages = let
startOnly = config.serviceConfig.RootDirectoryStartOnly or false;
execOpts = if startOnly then [ "ExecStart" ] else [
execOpts = [
"ExecReload" "ExecStart" "ExecStartPost" "ExecStartPre" "ExecStop"
"ExecStopPost"
];