oysteikt
/
mpd
0
0
Fork 0
Code Issues Pull Requests Releases Activity

systemd: base "RestrictAddressFamilies" on build options 

This allows to not allow `AF_NETLINK` if `smbclient` is not enabled.
This commit is contained in:
naglis 2023-09-15 22:27:19 +03:00
parent df069bc456
commit bdfe5e97cd
3 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
systemd/meson.build
View File

@ -1,6 +1,13 @@
systemd_unit_conf = configuration_data() systemd_unit_conf = configuration_data()
systemd_unit_conf.set('prefix', get_option('prefix')) systemd_unit_conf.set('prefix', get_option('prefix'))
address_families = ['AF_INET', 'AF_INET6', 'AF_UNIX']
if get_option('smbclient').enabled()
# AF_NETLINK is required by libsmbclient, or it will exit() .. *sigh*
address_families += 'AF_NETLINK'
endif
systemd_unit_conf.set('address_families', ' '.join(address_families))
systemd_socket_conf = configuration_data() systemd_socket_conf = configuration_data()
listen_streams = [] listen_streams = []
if get_option('local_socket') if get_option('local_socket')

3
systemd/system/mpd.service.in
View File

@ -27,8 +27,7 @@ NoNewPrivileges=yes
ProtectKernelTunables=yes ProtectKernelTunables=yes
ProtectControlGroups=yes ProtectControlGroups=yes
ProtectKernelModules=yes ProtectKernelModules=yes
# AF_NETLINK is required by libsmbclient, or it will exit() .. *sigh* RestrictAddressFamilies=@address_families@
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
RestrictNamespaces=yes RestrictNamespaces=yes
[Install] [Install]

3
systemd/user/mpd.service.in
View File

@ -28,8 +28,7 @@ ProtectSystem=yes
NoNewPrivileges=yes NoNewPrivileges=yes
ProtectKernelTunables=yes ProtectKernelTunables=yes
ProtectControlGroups=yes ProtectControlGroups=yes
# AF_NETLINK is required by libsmbclient, or it will exit() .. *sigh* RestrictAddressFamilies=@address_families@
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
RestrictNamespaces=yes RestrictNamespaces=yes
# Note that "ProtectKernelModules=yes" is missing in the user unit # Note that "ProtectKernelModules=yes" is missing in the user unit