units: make use of the new !! ExecStart= prefix in systemd-resolved.service

Let's make use of !! to run resolved with ambient capabilities on
systems supporting them.

diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c
index 74603f93112f647a4bf9993c502157ef357f52f1..8fd81956b8316a643091ee6bd95d0056e3b24794 100644 (file)
--- a/src/resolve/resolved.c
+++ b/src/resolve/resolved.c
@@ -67,13 +67,18 @@ int main(int argc, char *argv[]) {
                 goto finish;
         }
 
-        /* Drop privileges, but keep three caps. Note that we drop those too, later on (see below) */
-        r = drop_privileges(uid, gid,
-                            (UINT64_C(1) << CAP_NET_RAW)|          /* needed for SO_BINDTODEVICE */
-                            (UINT64_C(1) << CAP_NET_BIND_SERVICE)| /* needed to bind on port 53 */
-                            (UINT64_C(1) << CAP_SETPCAP)           /* needed in order to drop the caps later */);
-        if (r < 0)
-                goto finish;
+        /* Drop privileges, but only if we have been started as root. If we are not running as root we assume all
+         * privileges are already dropped. */
+        if (getuid() == 0) {
+
+                /* Drop privileges, but keep three caps. Note that we drop those too, later on (see below) */
+                r = drop_privileges(uid, gid,
+                                    (UINT64_C(1) << CAP_NET_RAW)|          /* needed for SO_BINDTODEVICE */
+                                    (UINT64_C(1) << CAP_NET_BIND_SERVICE)| /* needed to bind on port 53 */
+                                    (UINT64_C(1) << CAP_SETPCAP)           /* needed in order to drop the caps later */);
+                if (r < 0)
+                        goto finish;
+        }
 
         assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, SIGUSR1, SIGUSR2, -1) >= 0);
 

diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in
index 9821e1cfee7f14003a72d974f117bab68c3f4563..ba8d3f6bb1656e1760c09cb00626a09ca6ec9cf0 100644 (file)
--- a/units/systemd-resolved.service.in
+++ b/units/systemd-resolved.service.in
@@ -19,9 +19,11 @@ Wants=nss-lookup.target
 Type=notify
 Restart=always
 RestartSec=0
-ExecStart=@rootlibexecdir@/systemd-resolved
+ExecStart=!!@rootlibexecdir@/systemd-resolved
 WatchdogSec=3min
-CapabilityBoundingSet=CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_NET_RAW CAP_NET_BIND_SERVICE
+User=systemd-resolve
+CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
 PrivateTmp=yes
 PrivateDevices=yes
 ProtectSystem=strict
@@ -34,7 +36,8 @@ RestrictRealtime=yes
 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
 SystemCallArchitectures=native
-ReadWritePaths=/run/systemd
+RuntimeDirectory=systemd/resolve
+RuntimeDirectoryPreserve=yes
 
 [Install]
 WantedBy=multi-user.target