mirrors
/
tailscale
mirror of https://github.com/tailscale/tailscale.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
tailscale/cmd/tailscaled/tailscaled.service

42 lines
991 B
SYSTEMD
Raw Permalink Normal View History

tailscaled: add a systemd unit. Signed-off-by: David Anderson <dave@natulte.net>
2020-02-18 21:30:54 +00:00
[Unit]
Description=Tailscale node agent
Documentation=https://tailscale.com/kb/
Wants=network-pre.target
After=network-pre.target
[Service]
EnvironmentFile=/etc/default/tailscaled
tailscaled.service: also cleanup prior to starting. Fixes #813. Signed-off-by: David Anderson <danderson@tailscale.com>
2020-11-10 04:13:51 +00:00
ExecStartPre=/usr/sbin/tailscaled --cleanup
tailscaled: fix systemd unit definition. Port number has to be by itself for substitution to work. Disabling the restart rate-limiting has to be in [Unit] not [Service]. Signed-off-by: David Anderson <dave@natulte.net>
2020-02-18 21:46:03 +00:00
ExecStart=/usr/sbin/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/run/tailscale/tailscaled.sock --port $PORT $FLAGS
cmd/tailscaled: graceful shutdown (#534) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>
2020-07-13 11:17:58 +01:00
ExecStopPost=/usr/sbin/tailscaled --cleanup
tailscaled: add a systemd unit. Signed-off-by: David Anderson <dave@natulte.net>
2020-02-18 21:30:54 +00:00
Restart=on-failure
RuntimeDirectory=tailscale
RuntimeDirectoryMode=0755
StateDirectory=tailscale
StateDirectoryMode=0750
cmd/tailscaled: set CacheDirectory in service. Signed-off-by: David Anderson <dave@natulte.net>
2020-04-05 00:51:40 +01:00
CacheDirectory=tailscale
CacheDirectoryMode=0750
ipn/ipnserver: enable systemd-notify support Addresses #964 Still to be done: - Figure out the correct logging lines in util/systemd - Figure out if we need to slip the systemd.Status function anywhere else - Log util/systemd errors? (most of the errors are of the "you cannot do anything about this, but it might be a bad idea to crash the program if it errors" kind) Assistance in getting this over the finish line would help a lot. Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: rename the nonlinux file to appease the magic Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix package name Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix review feedback from @mdlayher Signed-off-by: Christine Dodrill <me@christine.website> cmd/tailscale{,d}: update depaware manifests Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: use sync.Once instead of func init Signed-off-by: Christine Dodrill <me@christine.website> control/controlclient: minor review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> {control,ipn,systemd}: fix review feedback Signed-off-by: Christine Dodrill <me@christine.website> review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> ipn: fix sprintf call Signed-off-by: Christine Dodrill <me@christine.website> ipn: make staticcheck less sad Signed-off-by: Christine Dodrill <me@christine.website> ipn: print IP address in connected status Signed-off-by: Christine Dodrill <me@christine.website> ipn: review feedback Signed-off-by: Christine Dodrill <me@christine.website> final fixups Signed-off-by: Christine Dodrill <me@christine.website>
2020-11-24 23:35:04 +00:00
Type=notify
tailscaled: add a systemd unit. Signed-off-by: David Anderson <dave@natulte.net>
2020-02-18 21:30:54 +00:00
tailscaled.service: Lock down clock and /dev (#1071) Research in issue #1063 uncovered why tailscaled would fail with ProtectClock enabled (it implicitly enabled DevicePolicy=closed). This knowledge in turn also opens the door for locking down /dev further, e.g. explicitly setting DevicePolicy=strict (instead of closed), and making /dev private for the unit. Additional possible future (or downstream) lockdown that can be done is setting `PrivateDevices=true` (with `BindPaths=/dev/net/`), however, systemd 233 or later is required for this, and tailscaled currently need to work for systemd down to version 215. Closes https://github.com/tailscale/tailscale/issues/1063 Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>
2020-12-27 12:04:36 +00:00
DeviceAllow=/dev/net/tun
DeviceAllow=/dev/null
DeviceAllow=/dev/random
DeviceAllow=/dev/urandom
DevicePolicy=strict
tailscaled.service: Harden systemd unit somewhat (#1062) While not a full capability lockdown of the systemd unit, this still improves sandboxing and security of the running process a good deal. Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>
2020-12-25 00:14:58 +00:00
LockPersonality=true
MemoryDenyWriteExecute=true
PrivateTmp=true
tailscaled.service: Lock down clock and /dev (#1071) Research in issue #1063 uncovered why tailscaled would fail with ProtectClock enabled (it implicitly enabled DevicePolicy=closed). This knowledge in turn also opens the door for locking down /dev further, e.g. explicitly setting DevicePolicy=strict (instead of closed), and making /dev private for the unit. Additional possible future (or downstream) lockdown that can be done is setting `PrivateDevices=true` (with `BindPaths=/dev/net/`), however, systemd 233 or later is required for this, and tailscaled currently need to work for systemd down to version 215. Closes https://github.com/tailscale/tailscale/issues/1063 Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>
2020-12-27 12:04:36 +00:00
ProtectClock=true
tailscaled.service: Harden systemd unit somewhat (#1062) While not a full capability lockdown of the systemd unit, this still improves sandboxing and security of the running process a good deal. Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com>
2020-12-25 00:14:58 +00:00
ProtectControlGroups=true
ProtectHome=true
ProtectKernelTunables=true
ProtectSystem=strict
ReadWritePaths=/etc/
RestrictSUIDSGID=true
SystemCallArchitectures=native
tailscaled: add a systemd unit. Signed-off-by: David Anderson <dave@natulte.net>
2020-02-18 21:30:54 +00:00
[Install]
WantedBy=multi-user.target