Ensure freeradius can write its pidfile

diff --git a/debian/freeradius.service b/debian/freeradius.service
index 26e49d39f390fb36c1ab9786cb7fa664d185b528..0da15a515b78cf9e891c697f1958cc9b107c879b 100644 (file)
--- a/debian/freeradius.service
+++ b/debian/freeradius.service
@@ -23,8 +23,16 @@ Environment=HOSTNAME=%H
 # a leak somewhere.
 MemoryLimit=2G
 
+# Ensure the daemon can still write its pidfile after it drops
+# privileges. Combination of options that work on a variety of
+# systems. Test very carefully if you alter these lines.
 RuntimeDirectory=freeradius
 RuntimeDirectoryMode=0775
+# This does not work on Debian Jessie:
+Group=freerad
+# This does not work on Ubuntu Bionic:
+ExecStartPre=/bin/chown freerad:freerad /var/run/freeradius
+
 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout
 ExecStart=/usr/sbin/freeradius $FREERADIUS_OPTIONS
 Restart=on-failure