example docs for tmpdir with systemd. Fixes #5066

diff --git a/debian/freeradius.service b/debian/freeradius.service
index fc745bd5be72c3331328d167283cd76994164f0e..e6f8f91900c3aacbdb0d9fd25b67812148c4896e 100644 (file)
--- a/debian/freeradius.service
+++ b/debian/freeradius.service
@@ -25,7 +25,7 @@ MemoryLimit=2G
 # Ensure the daemon can still write its pidfile after it drops
 # privileges. Combination of options that work on a variety of
 # systems. Test very carefully if you alter these lines.
-RuntimeDirectory=freeradius
+RuntimeDirectory=freeradius freeradius/tmp
 RuntimeDirectoryMode=0775
 # This does not work on Debian Jessie:
 User=freerad

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index b937d22af23512142e10b37c0a679fa29d54146c..84660d7c1e84d9cdd144b2ceba08a44ebc44d7e1 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -690,6 +690,12 @@ eap {
                        #  You should also delete all of the files
                        #  in the directory when the server starts.
                        #
+                       #  Note that, on Linux systems with systemd, the
+                       #  /tmp directory may be restricted. In this case
+                       #  it may be best to use `${run_dir}/tmp` here
+                       #  and create the temporary directory with the
+                       #  systemd `RuntimeDirectory` unit option.
+                       #
                #       tmpdir = /tmp/radiusd
 
                        #  The command used to verify the client cert.

diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls
index f75eda82e2c636f2a190d7ed64f39cc6f7885f00..08e459080fe75916901481c0663c7a1698f6b87a 100644 (file)
--- a/raddb/sites-available/tls
+++ b/raddb/sites-available/tls
@@ -453,7 +453,14 @@ listen {
                        #
                        #  You should also delete all of the files
                        #  in the directory when the server starts.
-       #               tmpdir = /tmp/radiusd
+                       #
+                       #  Note that, on Linux systems with systemd, the
+                       #  /tmp directory may be restricted. In this case
+                       #  it may be best to use `${run_dir}/tmp` here
+                       #  and create the temporary directory with the
+                       #  systemd `RuntimeDirectory` unit option.
+                       #
+       #               tmpdir = /tmp/radiusd
 
                        #  The command used to verify the client cert.
                        #  We recommend using the OpenSSL command-line
@@ -467,7 +474,7 @@ listen {
                        #  in PEM format.  This file is automatically
                        #  deleted by the server when the command
                        #  returns.
-       #               client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
+       #               client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
                }
 
                #

diff --git a/redhat/radiusd.service b/redhat/radiusd.service
index 4b12cd3ab9944130310deeb9199401107d2db528..0648372a07973ef0f55fd9b9b3da21fdcdb524c9 100644 (file)
--- a/redhat/radiusd.service
+++ b/redhat/radiusd.service
@@ -22,7 +22,7 @@ Environment=HOSTNAME=%H
 # a leak somewhere.
 MemoryLimit=2G
 
-RuntimeDirectory=radiusd
+RuntimeDirectory=radiusd radiusd/tmp
 RuntimeDirectoryMode=0775
 User=radiusd
 Group=radiusd