rec: create service file with User/Group

diff --git a/pdns/recursordist/Makefile.am b/pdns/recursordist/Makefile.am
index 12d93f680fd8040b3b8f54757be5ebd3a7d334ca..7e31711f4b591e3a8f9cda6422fec1947154fee3 100644 (file)
--- a/pdns/recursordist/Makefile.am
+++ b/pdns/recursordist/Makefile.am
@@ -493,7 +493,7 @@ endif
 
 if HAVE_SYSTEMD
 pdns-recursor.service: pdns-recursor.service.in
-       $(AM_V_GEN)sed -e 's![@]sbindir[@]!$(sbindir)!' < $< > $@
+       $(AM_V_GEN)sed -e 's![@]sbindir[@]!$(sbindir)!' -e 's![@]service_user[@]!$(service_user)!' -e 's![@]service_group[@]!$(service_group)!' < $< > $@
 if !HAVE_SYSTEMD_LOCK_PERSONALITY
        $(AM_V_GEN)perl -ni -e 'print unless /^LockPersonality/' $@
 endif

diff --git a/pdns/recursordist/configure.ac b/pdns/recursordist/configure.ac
index 3d2b20f555f5b1e27ded837b07a238f158f4391a..7cc54f1de7b60837cd5738805944c5278bb96db6 100644 (file)
--- a/pdns/recursordist/configure.ac
+++ b/pdns/recursordist/configure.ac
@@ -173,6 +173,7 @@ PDNS_ENABLE_VALGRIND
 AX_AVAILABLE_SYSTEMD
 AX_CHECK_SYSTEMD_FEATURES
 AM_CONDITIONAL([HAVE_SYSTEMD], [ test x"$systemd" = "xy" ])
+PDNS_WITH_SERVICE_USER([pdns-recursor])
 PDNS_CHECK_VIRTUALENV
 
 AC_SUBST(LIBS)

diff --git a/pdns/recursordist/m4/pdns_with_service_user.m4 b/pdns/recursordist/m4/pdns_with_service_user.m4
new file mode 120000 (symlink)
index 0000000..bc72a6e
--- /dev/null
+++ b/pdns/recursordist/m4/pdns_with_service_user.m4
@@ -0,0 +1 @@
+../../../m4/pdns_with_service_user.m4
\ No newline at end of file

diff --git a/pdns/recursordist/pdns-recursor.service.in b/pdns/recursordist/pdns-recursor.service.in
index 357af43290bec09768ab7cf121831d04e4084a14..ce9472c7678c812077633ee1436f893361effe42 100644 (file)
--- a/pdns/recursordist/pdns-recursor.service.in
+++ b/pdns/recursordist/pdns-recursor.service.in
@@ -8,6 +8,8 @@ After=network-online.target
 
 [Service]
 ExecStart=@sbindir@/pdns_recursor --daemon=no --write-pid=no --disable-syslog --log-timestamp=no
+User=@service_user@
+Group=@service_group@
 Type=notify
 Restart=on-failure
 StartLimitInterval=0
@@ -16,7 +18,8 @@ StartLimitInterval=0
 LimitNOFILE=16384
 
 # Sandboxing
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_CHOWN CAP_SYS_CHROOT
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_CHOWN
+AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_CHOWN
 LockPersonality=true
 NoNewPrivileges=true
 PrivateDevices=true