Zbigniew Jędrzejewski-Szmek
9c665ee7aa
The new unit is nice, but it might not be appropriate in all scenarios. It requires a new kernel, which might be known to not be available, and also changes sysctl kernel.core_pattern at runtime, which might not be desired. Replace static enablement by a normal [Install] section and add the unit to presets to enable it by default. The awkward instructions in the man page are simplified and adjusted.
63 lines
1.7 KiB
Plaintext
63 lines
1.7 KiB
Plaintext
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=Listen Kernel Core Dump Socket
|
|
Documentation=man:systemd-coredump(8)
|
|
|
|
DefaultDependencies=no
|
|
After=local-fs.target systemd-journald.socket
|
|
Before=shutdown.target sysinit.target systemd-coredump-register.service
|
|
Conflicts=shutdown.target
|
|
Requires=systemd-journald.socket
|
|
Upholds=systemd-coredump-register.service
|
|
|
|
ConditionVirtualization=!container
|
|
|
|
[Service]
|
|
Type=notify-reload
|
|
ExecCondition={{LIBEXECDIR}}/systemd-coredump --check-requirements
|
|
ExecStart={{LIBEXECDIR}}/systemd-coredump --manager
|
|
|
|
CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETGID CAP_SETPCAP CAP_SETUID CAP_SYS_ADMIN CAP_SYS_CHROOT CAP_SYS_PTRACE
|
|
FileDescriptorStoreMax=512
|
|
FileDescriptorStorePreserve=yes
|
|
IPAddressDeny=any
|
|
KillMode=mixed
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
Nice=9
|
|
NoNewPrivileges=yes
|
|
OOMScoreAdjust=-1000
|
|
PrivateDevices=yes
|
|
PrivateNetwork=yes
|
|
PrivateTmp=disconnected
|
|
ProtectClock=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHome=read-only
|
|
ProtectHostname=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectSystem=strict
|
|
Restart=on-failure
|
|
RestartSec=0
|
|
RestrictAddressFamilies=AF_UNIX
|
|
RestrictRealtime=yes
|
|
RuntimeDirectory=systemd/coredumpd
|
|
RuntimeDirectoryPreserve=yes
|
|
StateDirectory=systemd/coredump
|
|
SystemCallArchitectures=native
|
|
SystemCallErrorNumber=EPERM
|
|
SystemCallFilter=@system-service @mount
|
|
TimeoutStopSec=6min
|
|
{{SERVICE_WATCHDOG}}
|
|
|
|
[Install]
|
|
WantedBy=sysinit.target
|