tobias/garage_ynh
1
0
Fork 0
Code Issues 1 Pull Requests Projects Releases Wiki Activity

change systemd file if virtualisation is enabled

Browse Source
This commit is contained in:
oiseauroch 2022-12-22 16:14:33 +01:00
parent 827c9425b0
commit ff6be76e85
2 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
conf/systemd.service
View File

@ -17,16 +17,16 @@ StandardError=inherit
# Depending on specificities of your service/app, you may need to tweak these # Depending on specificities of your service/app, you may need to tweak these
# .. but this should be a good baseline # .. but this should be a good baseline
# Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html # Details for these options: https://www.freedesktop.org/software/systemd/man/systemd.exec.html
PrivateTmp=yes __VIRT_PROTECTION__PrivateTmp=yes
#PrivateDevices=yes #PrivateDevices=yes
# RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 # RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes RestrictNamespaces=yes
RestrictRealtime=yes RestrictRealtime=yes
#DevicePolicy=closed #DevicePolicy=closed
ProtectSystem=full __VIRT_PROTECTION__ProtectSystem=full
ProtectControlGroups=yes __VIRT_PROTECTION__ProtectControlGroups=yes
#ProtectKernelModules=yes #ProtectKernelModules=yes
ProtectKernelTunables=yes __VIRT_PROTECTION__ProtectKernelTunables=yes
LockPersonality=yes LockPersonality=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap

6
scripts/install
View File

@ -93,9 +93,13 @@ if [ "$(which modprobe)" = "" ]
then then
virtualisation=false virtualisation=false
export VIRTUALISATION=false export VIRTUALISATION=false
# uncomment systemd isolation
virt_protection=""
else else
export VIRTUALISATION=false export VIRTUALISATION=true
virtualisation=true virtualisation=true
# comment systemd isolation to allow mount disk
virt_protection="#"
fi fi
ynh_app_setting_set --app=$app --key=virtualisation --value=$virtualisation ynh_app_setting_set --app=$app --key=virtualisation --value=$virtualisation