Clayton Craft
6279910be7
Our first resolve happens way before sockets.target, and systemd-resolved-varlink.socket has no ordering of its own, so there's nothing making sure the socket is listening by then. Without this the connect fails and we quietly fall back to getaddrinfo(), which is exactly the case the varlink path is there for. Order after both the service and the socket since either one is enough on its own but neither covers every install situation. For example resolved binds the socket itself when nothing hands it one, and on systems where only the socket is enabled the service isn't started at boot at all.
57 lines
1.6 KiB
Plaintext
57 lines
1.6 KiB
Plaintext
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=Network Time Synchronization
|
|
Documentation=man:systemd-timesyncd.service(8)
|
|
ConditionCapability=CAP_SYS_TIME
|
|
ConditionVirtualization=!container
|
|
DefaultDependencies=no
|
|
After=systemd-sysusers.service systemd-resolved.service systemd-resolved-varlink.socket
|
|
Before=time-set.target sysinit.target shutdown.target
|
|
Conflicts=shutdown.target
|
|
Wants=time-set.target
|
|
|
|
[Service]
|
|
AmbientCapabilities=CAP_SYS_TIME
|
|
BusName=org.freedesktop.timesync1
|
|
CapabilityBoundingSet=CAP_SYS_TIME
|
|
ExecStart={{LIBEXECDIR}}/systemd-timesyncd
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateTmp=disconnected
|
|
ProtectProc=invisible
|
|
ProtectControlGroups=yes
|
|
ProtectHome=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectSystem=strict
|
|
Restart=always
|
|
RestartSec=0
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
RuntimeDirectory=systemd/timesync
|
|
StateDirectory=systemd/timesync
|
|
SystemCallArchitectures=native
|
|
SystemCallErrorNumber=EPERM
|
|
SystemCallFilter=@system-service @clock
|
|
Type=notify
|
|
User=systemd-timesync
|
|
{{SERVICE_WATCHDOG}}
|
|
|
|
[Install]
|
|
WantedBy=sysinit.target
|
|
Alias=dbus-org.freedesktop.timesync1.service
|