Meson: Support pdns-auth and ixfrdist service files

Service files are treated like a config.h.in file. This adds support for a common base of
service file configuration options containing basic systemd feature checks.

Then, each of pdns-auth and ixfrdist have their own "general" and "instance" service files
that are generated from a common service file. This is why things like @Description@,
@ConfigName@ and @Config@ are made generic so that each version of the service file can
use it own string.

diff --git a/auth/systemd/ixfrdist.service.in b/auth/systemd/ixfrdist.service.in
new file mode 100644 (file)
index 0000000..556be42
--- /dev/null
+++ b/auth/systemd/ixfrdist.service.in
@@ -0,0 +1,44 @@
+[Unit]
+Description=@Description@
+Documentation=man:ixfrdist(1)
+Documentation=man:ixfrdist.yml(5)
+Documentation=https://doc.powerdns.com
+Wants=network-online.target
+After=network-online.target time-sync.target
+
+[Service]
+Type=simple
+ExecStart=@BinDir@/ixfrdist @Config@
+Restart=on-failure
+RestartSec=1
+StartLimitInterval=0
+
+# Sandboxing
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID
+NoNewPrivileges=true
+DevicePolicy=closed
+@LockPersonality@
+@PrivateDevices@
+@PrivateTmp@
+@PrivateUsers@
+@ProtectClock@
+@ProtectControlGroups@
+@ProtectHome@
+@ProtectHostname@
+@ProtectKernelLogs@
+@ProtectKernelModules@
+@ProtectKernelTunables@
+@ProtectSystem@
+@RestrictAddressFamilies@
+@RestrictNamespaces@
+@RestrictRealtime@
+@RestrictSUIDSGID@
+@SystemCallArchitectures@
+@SystemCallFilter@
+@ProtectProc@
+@PrivateIPC@
+@RemoveIPC@
+@MemoryDenyWriteExecute@
+
+[Install]
+WantedBy=multi-user.target

diff --git a/auth/systemd/pdns-auth.service.in b/auth/systemd/pdns-auth.service.in
new file mode 100644 (file)
index 0000000..536c8ba
--- /dev/null
+++ b/auth/systemd/pdns-auth.service.in
@@ -0,0 +1,49 @@
+[Unit]
+Description=@Description@
+Documentation=man:pdns-auth(1)
+Documentation=man:pdns-auth-control(1)
+Documentation=https://doc.powerdns.com
+Wants=network-online.target
+After=network-online.target mysql.service mysqld.service postgresql.service slapd.service mariadb.service time-sync.target
+
+[Service]
+ExecStart=@StaticBinDir@/pdns-auth @ConfigName@ @SocketDir@ --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no
+SyslogIdentifier=@SyslogIdentifier@
+User=@ServiceUser@
+Group=@ServiceGroup@
+Type=notify
+Restart=on-failure
+RestartSec=1
+StartLimitInterval=0
+RuntimeDirectory=@RuntimeDirectory@
+
+# Sandboxing
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_CHOWN
+AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_CHOWN
+NoNewPrivileges=true
+DevicePolicy=closed
+@LockPersonality@
+@PrivateDevices@
+@PrivateTmp@
+@PrivateUsers@
+@ProtectClock@
+@ProtectControlGroups@
+@ProtectHome@
+@ProtectHostname@
+@ProtectKernelLogs@
+@ProtectKernelModules@
+@ProtectKernelTunables@
+@ProtectSystem@
+@RestrictAddressFamilies@
+@RestrictNamespaces@
+@RestrictRealtime@
+@RestrictSUIDSGID@
+@SystemCallArchitectures@
+@SystemCallFilter@
+@ProtectProc@
+@PrivateIPC@
+@RemoveIPC@
+@MemoryDenyWriteExecute@
+
+[Install]
+WantedBy=multi-user.target

diff --git a/meson.build b/meson.build
index 686f7abacfeb841a3c5aa7d6feddc98f9d84d12b..f09590f5aa3b521c733ecab71af448448da17dd1 100644 (file)
--- a/meson.build
+++ b/meson.build
@@ -151,20 +151,132 @@ deps = [
 ]
 
 if dep_systemd.found()
+  systemd_service_conf = configuration_data()
+  systemd_service_conf.set('BinDir', get_option('bindir'))
+  systemd_service_conf.set('StaticBinDir', get_option('sbindir'))
   systemd_service_user = get_option('systemd-service-user')
   systemd_service_group = get_option('systemd-service-group')
-  systemd_service = configure_file(
-    input: src_dir / 'pdns.service.in',
+  systemd_service_conf.set('ServiceUser', systemd_service_user)
+  systemd_service_conf.set('ServiceGroup', systemd_service_group)
+  summary('Service User', systemd_service_user, section: 'Systemd')
+  summary('Service Group', systemd_service_group, section: 'Systemd')
+
+  # ProtectSystem=full will disallow write access to /etc and /usr, possibly not being
+  # able to write slaved-zones into sqlite3 or zonefiles.
+  systemd_service_conf.set(
+    'ProtectSystem', have_systemd_protect_system ? 'ProtectSystem=full' : '',
+  )
+  systemd_service_conf.set(
+    'SystemCallArchitectures',
+    have_systemd_system_call_architectures ? 'SystemCallArchitectures=native' : '',
+  )
+  systemd_system_call_filter = '~ @clock @debug @module @mount @raw-io @reboot @swap @cpu-emulation @obsolete'
+  systemd_service_conf.set(
+    'SystemCallFilter',
+    have_systemd_system_call_filter ? 'SystemCallFilter=' + systemd_system_call_filter : '',
+  )
+  systemd_service_conf.set(
+    'ProtectProc',
+    have_systemd_protect_proc ? 'ProtectProc=invisible' : '',
+  )
+
+  systemd_features = {
+    'LockPersonality': have_systemd_lock_personality,
+    'PrivateDevices': have_systemd_private_devices,
+    'PrivateTmp': have_systemd_private_tmp,
+    'PrivateUsers': false, # Setting it to true prevents us from opening our sockets.
+    'ProtectClock': have_systemd_protect_clock,
+    'ProtectControlGroups': have_systemd_protect_control_groups,
+    'ProtectHome': have_systemd_protect_home,
+    'ProtectHostname': have_systemd_protect_hostname,
+    'ProtectKernelLogs': have_systemd_protect_kernel_logs,
+    'ProtectKernelModules': have_systemd_protect_kernel_modules,
+    'ProtectKernelTunables': have_systemd_protect_kernel_tunables,
+    'RestrictNamespaces': have_systemd_restrict_namespaces,
+    'RestrictRealtime': have_systemd_restrict_realtime,
+    'RestrictSUIDSGID': have_systemd_restrict_suidsgid,
+    'PrivateIPC': have_systemd_private_ipc,
+    'RemoveIPC': have_systemd_remove_ipc,
+  }
+
+  foreach feature, enable_it: systemd_features
+    systemd_service_conf.set(feature, enable_it ? feature + '=true': '')
+  endforeach
+
+  auth_service_conf = configuration_data()
+  auth_service_conf.merge_from(systemd_service_conf)
+  # Disabled, it breaks LuaJIT.
+  auth_service_conf.set(
+    'MemoryDenyWriteExecute',
+    have_systemd_memory_deny_write_execute ? 'MemoryDenyWriteExecute=false' : '',
+  )
+  auth_service_conf.set(
+    'RestrictAddressFamilies',
+    have_systemd_restrict_address_families ? 'RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6' : '',
+  )
+
+  enable_socket_dir = (not have_systemd_with_runtime_dir_env) and have_systemd_percent_t
+
+  auth_service_conf_general = configuration_data()
+  auth_service_conf_general.merge_from(auth_service_conf)
+  auth_service_conf_general.set('Description', 'PowerDNS Authoritative Server')
+  auth_service_conf_general.set('SocketDir', enable_socket_dir ? '--socket-dir=%t/pdns-auth' : '')
+  auth_service_conf_general.set('SyslogIdentifier', 'pdns-auth')
+  auth_service_conf_general.set('RuntimeDirectory', 'pdns-auth')
+
+  configure_file(
+    input: 'auth' / 'systemd' / 'pdns-auth.service.in',
     output: 'pdns-auth.service',
-    configuration: {
-      'sbindir': get_option('sbindir'),
-      'service_user': systemd_service_user,
-      'service_group': systemd_service_group,
-    },
+    configuration: auth_service_conf_general,
   )
 
-  summary('Service User', systemd_service_user, section: 'Systemd')
-  summary('Service Group', systemd_service_group, section: 'Systemd')
+  auth_service_conf_instance = configuration_data()
+  auth_service_conf_instance.merge_from(auth_service_conf)
+  auth_service_conf_instance.set('Description', 'PowerDNS Authoritative Server %i')
+  auth_service_conf_instance.set('ConfigName', '--config-name=%i')
+  auth_service_conf_instance.set('SocketDir', enable_socket_dir ? '--socket-dir=%t/pdns-auth-%i' : '')
+  auth_service_conf_instance.set('SyslogIdentifier', 'pdns-auth-%i')
+  auth_service_conf_instance.set('RuntimeDirectory', have_systemd_percent_t ? 'pdns-auth-%i' : 'pdns-auth')
+
+  configure_file(
+    input: 'auth' / 'systemd' / 'pdns-auth.service.in',
+    output: 'pdns-auth@.service',
+    configuration: auth_service_conf_instance,
+  )
+
+  if get_option('tools-ixfrdist')
+    ixfrdist_service_conf = configuration_data()
+    ixfrdist_service_conf.merge_from(systemd_service_conf)
+    ixfrdist_service_conf.set(
+      'MemoryDenyWriteExecute',
+      have_systemd_memory_deny_write_execute ? 'MemoryDenyWriteExecute=true' : '',
+    )
+    ixfrdist_service_conf.set(
+      'RestrictAddressFamilies',
+      have_systemd_restrict_address_families ? 'RestrictAddressFamilies=AF_INET AF_INET6' : '',
+    )
+
+    ixfrdist_service_conf_general = configuration_data()
+    ixfrdist_service_conf_general.merge_from(ixfrdist_service_conf)
+    ixfrdist_service_conf_general.set('Description', 'PowerDNS IXFR Distributor')
+
+    configure_file(
+      input: 'auth' / 'systemd' / 'ixfrdist.service.in',
+      output: 'ixfrdist.service',
+      configuration: ixfrdist_service_conf_general,
+    )
+
+    ixfrdist_service_conf_instance = configuration_data()
+    ixfrdist_service_conf_instance.merge_from(ixfrdist_service_conf)
+    ixfrdist_service_conf_instance.set('Description', 'PowerDNS IXFR Distributor %i')
+    ixfrdist_service_conf_instance.set('Config', '--config=' + get_option('sysconfdir') + '/ixfrdist-%.ymli')
+
+    configure_file(
+      input: 'auth' / 'systemd' / 'ixfrdist.service.in',
+      output: 'ixfrdist@.service',
+      configuration: ixfrdist_service_conf_instance,
+    )
+  endif
 endif
 
 libpdns_bindlexer_source = src_dir / 'bindlexer.l'