diff options
| -rw-r--r-- | .gitignore | 2 | ||||
| -rw-r--r-- | Makefile.in | 6 | ||||
| -rw-r--r-- | random-seed-save.service.in (renamed from random-seed-save.service) | 2 | ||||
| -rw-r--r-- | random-seed.service | 28 |
4 files changed, 6 insertions, 32 deletions
@@ -8,6 +8,8 @@ config.status configure /Makefile +/random-seed.service +/random-seed-save.service /random-seed /random-seed.test *.o diff --git a/Makefile.in b/Makefile.in index f52121e..ab22121 100644 --- a/Makefile.in +++ b/Makefile.in @@ -22,7 +22,7 @@ SRC := random-seed.c sha2.c util.c OBJ := $(SRC:.c=.o) TEST_FILE := random-seed.test -all: random-seed random-seed.service +all: random-seed random-seed.service random-seed-save.service random-seed: $(OBJ) @@ -32,10 +32,10 @@ util.o: util.c util.h sha2.h sha2.o: sha2.c sha2.h -random-seed.service: random-seed.service.in +random-seed.service random-seed-save.service: Makefile sed -e 's|@sbindir[@]|$(sbindir)|g' \ -e 's|@default_seed_path_dir[@]|$(default_seed_path_dir)|g' \ - $< > $@ + $@.in > $@ install: all install -D -m755 random-seed $(DESTDIR)$(sbindir)/random-seed diff --git a/random-seed-save.service b/random-seed-save.service.in index a9858bc..e70192b 100644 --- a/random-seed-save.service +++ b/random-seed-save.service.in @@ -5,7 +5,7 @@ After=systemd-remount-fs.service [Service] ExecStart=@sbindir@/random-seed save -CapabilityBoundingSet=CAP_SYS_ADMIN +CapabilityBoundingSet= NoNewPrivileges=yes PrivateDevices=yes PrivateNetwork=yes diff --git a/random-seed.service b/random-seed.service deleted file mode 100644 index 04b2ef5..0000000 --- a/random-seed.service +++ /dev/null @@ -1,28 +0,0 @@ -[Unit] -Description=Random seed load/save -Documentation=man:random-seed(8) man:random(4) -DefaultDependencies=no -RequiresMountsFor=/var/lib -Conflicts=shutdown.target -After=systemd-remount-fs.service -Before=sysinit.target shutdown.target -ConditionVirtualization=!container - -[Service] -Type=oneshot -RemainAfterExit=yes -ExecStart=/usr/local/sbin/random-seed load -ExecStop=/usr/local/sbin/random-seed save -CapabilityBoundingSet=CAP_SYS_ADMIN -NoNewPrivileges=yes -PrivateDevices=yes -PrivateNetwork=yes -ProtectKernelTunables=yes -ProtectKernelModules=yes -LockPersonality=yes -TemporaryFileSystem=/:ro -BindPaths=/var/lib -TimeoutSec=30s - -[Install] -WantedBy=sysinit.target |