Skip to content

Commit

Permalink
enhancements to the systemd unit file
Browse files Browse the repository at this point in the history 
This uses now the same options which are used when starting wesnothd from within the wesnoth UI.
Systemd sandboxing has been added as well as an documentation entry.
The socket file seems to be not removed in most cases, thus it gets deleted afterwards.
  • Loading branch information
@sevu
sevu committed Feb 24, 2018
1 parent 2151ed6 commit b5ec7b8
Showing 1 changed file with 26 additions and 2 deletions.
28 changes: 26 additions & 2 deletions packaging/systemd/wesnothd.service.in
View file
@@ -1,9 +1,33 @@
[Unit]
Description=Wesnoth Multiplayer Server Daemon
Description=Wesnoth@BINARY_SUFFIX@ Multiplayer Server Daemon
Documentation=man:wesnothd(6)
After=network.target
# other wesnothd installations use the same port by default
# Conflicts=wesnothd-1.12.service wesnothd-1.10.service

[Service]
ExecStart=@CMAKE_INSTALL_FULL_BINDIR@/wesnothd
ExecStart=@CMAKE_INSTALL_FULL_BINDIR@/wesnothd@BINARY_SUFFIX@ -t 2 -T 5
# you can use -c to specify the same configuration file
# which is used when starting wensothd from within the wesnoth UI
# (and make sure wesnothd has the required access permissions)
ExecStopPost=/usr/bin/rm -f @FIFO_DIR@/socket
SyslogIdentifier=Wesnothd@BINARY_SUFFIX@

# Additional security-related features
# (when using the -c option, do not use the Protect options)
ProtectHome=yes
ProtectSystem=full
PrivateTmp=yes
PrivateDevices=yes
NoNewPrivileges=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictRealtime=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
ProtectControlGroups=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
RestrictNamespaces=yes

[Install]
WantedBy=multi-user.target

3 comments on commit b5ec7b8

@soliton-
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just wildly guessing since I don‘t know systemd syntax but are you sure AF_UNIX is necessary? I don‘t think we use unix sockets anywhere.

@GregoryLundberg
Copy link
Contributor

@GregoryLundberg GregoryLundberg commented on b5ec7b8 Feb 24, 2018 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On startup as a mere mortal, I see

$ ./wesnothd
20180224 10:08:09 error server: could not make fifo at '/var/run/wesnothd/socket' (Permission denied)

But, if, pretending to be a complete idiot, I ignore all reasonable precautions and do this, it works:

$ sudo wesnothd
opened fifo at '/var/run/wesnothd/socket'. Server commands may be written to this file.

And when I look I see:

$ netstat -ltn | grep 15000
tcp        0      0 0.0.0.0:15000           0.0.0.0:*               LISTEN

So, if we throw caution to the wind, we can use a named socket. But that's not an AF_UNIX port.

And we're only listening on an AF_INET (IPv4) port.

So, nether AF_UNIX nor AF_INET6 should be listed as we only use AF_INET.

The lack of AF_INET6 should be noted as an Issue.

@soliton-
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, not sure if we still don‘t support IPv6 or we just don‘t use it. But indeed that is more a missing feature.

Please sign in to comment.