mpd/systemd/user/mpd.service.in

[Unit]
Description=Music Player Daemon
Documentation=man:mpd(1) man:mpd.conf(5)
After=network.target sound.target

[Service]
Type=notify
ExecStart=@prefix@/bin/mpd --systemd

# Enable this setting to ask systemd to watch over MPD, see
# systemd.service(5).  This is disabled by default because it causes
# periodic wakeups which are unnecessary if MPD is not playing.
#WatchdogSec=120

# allow MPD to use real-time priority 40
LimitRTPRIO=40
LimitRTTIME=infinity

# for io_uring
LimitMEMLOCK=64M

# Required in order for ProtectSystem= (and other sandboxing) to work
PrivateUsers=yes
# disallow writing to /usr, /bin, /sbin, ...
ProtectSystem=yes

# more paranoid security settings
NoNewPrivileges=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
# AF_NETLINK is required by libsmbclient, or it will exit() .. *sigh*
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
RestrictNamespaces=yes

# Note that "ProtectKernelModules=yes" is missing in the user unit
# because systemd 232 is unable to reduce its own capabilities
# ("Failed at step CAPABILITIES spawning /usr/bin/mpd: Operation not
# permitted")

[Install]
WantedBy=default.target
Install systemd service file if systemd is available 2011-09-30 08:37:36 +02:00			`[Unit]`
			`Description=Music Player Daemon`
mpd.service: Set the Documentation option This makes references to mpd(1) and mpd(5) appear in systemd status output. 2015-07-17 19:55:23 +02:00			`Documentation=man:mpd(1) man:mpd.conf(5)`
mpd.service: depend on network.target Since some configurations use the "bind_to_address" option in their /etc/mpd.conf, the systemd service file must wait for the network.target or else mpd will start before it and thus fail due to no iface. 2012-11-21 17:26:23 +01:00			`After=network.target sound.target`
Install systemd service file if systemd is available 2011-09-30 08:37:36 +02:00
			`[Service]`
systemd: set Type=notify Tell systemd that MPD is going to notify it when initialization is done. 2016-02-26 16:14:06 +01:00			`Type=notify`
CommandLine: add option --systemd This way, MPD can reliably detect whether it was started as systemd service, which is better than checking sd_booted(), which only checks whether systemd manages all services, but still MPD could be started manually. 2021-11-05 08:48:19 +01:00			`ExecStart=@prefix@/bin/mpd --systemd`
Install systemd service file if systemd is available 2011-09-30 08:37:36 +02:00
lib/systemd/Watchdog: implement the systemd watchdog protocol 2018-08-02 11:15:35 +02:00			`# Enable this setting to ask systemd to watch over MPD, see`
			`# systemd.service(5). This is disabled by default because it causes`
			`# periodic wakeups which are unnecessary if MPD is not playing.`
			`#WatchdogSec=120`

thread/Util: lower the real-time priority from 50 to 40 On linux-rt, kernel IRQ threads are configured with priority=50, and this change configures MPD somewhat below that priority, leaving some room for other programs to be configured in between. Closes https://github.com/MusicPlayerDaemon/MPD/issues/643 2019-10-09 14:40:02 +02:00			`# allow MPD to use real-time priority 40`
			`LimitRTPRIO=40`
fix LimitRTTIME in systemd unit file systemd does not understand LimitRTTIME=-1. For no limit we have to use the string 'infinity' (see systemd.exec(5)). Signed-off-by: Christian Hesse <mail@eworm.de> 2015-12-01 08:53:35 +01:00			`LimitRTTIME=infinity`
systemd: assign real-time budget 2014-02-12 21:00:53 +01:00
systemnd: configure LimitMEMLOCK for io_uring The io_uring buffer is allocated as memlocked memory, as MPD needs to be able to lock memory. 2020-06-09 21:03:02 +02:00			`# for io_uring`
			`LimitMEMLOCK=64M`

systemd: use PrivateUsers= in user unit ProtectSystem= and other sandboxing options require a user namespace in order to work as user units (the user manager does not run as root and thus without a user namespace it is unable to perform mounts). 2022-11-04 00:11:13 +01:00			`# Required in order for ProtectSystem= (and other sandboxing) to work`
			`PrivateUsers=yes`
systemd: protect /usr when running under systemd 2015-08-11 19:00:21 +02:00			`# disallow writing to /usr, /bin, /sbin, ...`
			`ProtectSystem=yes`

systemd: more paranoid security settings 2016-12-09 10:36:02 +01:00			`# more paranoid security settings`
			`NoNewPrivileges=yes`
			`ProtectKernelTunables=yes`
			`ProtectControlGroups=yes`
			`# AF_NETLINK is required by libsmbclient, or it will exit() .. sigh`
			`RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK`
			`RestrictNamespaces=yes`

systemd: add user unit The user unit omits the "ProtectKernelModules" setting which fails with modular kernels: Failed at step CAPABILITIES spawning /usr/bin/mpd: Operation not permitted It is unfortunate that systemd (version 232) is unable to reduce its own capabilities, because this requires us to split system and user units. https://bugs.musicpd.org/view.php?id=4608 2016-12-13 08:41:55 +01:00			`# Note that "ProtectKernelModules=yes" is missing in the user unit`
			`# because systemd 232 is unable to reduce its own capabilities`
			`# ("Failed at step CAPABILITIES spawning /usr/bin/mpd: Operation not`
			`# permitted")`

Install systemd service file if systemd is available 2011-09-30 08:37:36 +02:00			`[Install]`
systemd: add user unit The user unit omits the "ProtectKernelModules" setting which fails with modular kernels: Failed at step CAPABILITIES spawning /usr/bin/mpd: Operation not permitted It is unfortunate that systemd (version 232) is unable to reduce its own capabilities, because this requires us to split system and user units. https://bugs.musicpd.org/view.php?id=4608 2016-12-13 08:41:55 +01:00			`WantedBy=default.target`