INN commit: branches/2.6/contrib (sample.init.systemd)
INN Commit
rra at isc.org
Mon Jan 11 21:55:09 UTC 2021
Date: Monday, January 11, 2021 @ 13:55:08
Author: iulius
Revision: 10507
Improve sample init systemd script
Thanks to Marco d'Itri, Debian packager of INN, for the ideas.
Also enable notify type.
Modified:
branches/2.6/contrib/sample.init.systemd
---------------------+
sample.init.systemd | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
Modified: sample.init.systemd
===================================================================
--- sample.init.systemd 2021-01-11 21:54:36 UTC (rev 10506)
+++ sample.init.systemd 2021-01-11 21:55:08 UTC (rev 10507)
@@ -5,26 +5,27 @@
[Unit]
Description=InterNetNews News Server
Documentation=https://www.eyrie.org/~eagle/software/inn/
-After=network.target
+After=network-online.target
+Wants=network-online.target
ConditionPathExists=/etc/news/inn.conf
[Service]
-Type=forking
+Type=notify
+Restart=on-abort
ExecStart=/usr/lib/news/bin/rc.news
ExecReload=/usr/sbin/ctlinnd -t 20 reload '' 'systemd unit reload'
-ExecStop=/bin/su -m news -s /bin/sh -c '/usr/lib/news/bin/rc.news stop'
+ExecStop=/usr/lib/news/bin/rc.news stop
PIDFile=/run/news/innd.pid
User=news
Group=news
AmbientCapabilities=CAP_NET_BIND_SERVICE
-PrivateDevices=true
PrivateTmp=true
ProtectControlGroups=true
ProtectHome=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
ProtectSystem=full
RuntimeDirectory=news
+LimitNOFILE=infinity
+ReadWritePaths=/var/spool/news/
# Setting NoNewPrivileges will break most local sendmail implementations
# because they're setuid or setgid to drop off mail in the mail queue. With
# this configuration, one can use mSMTP as the configured mta, set to forward
@@ -31,6 +32,12 @@
# mail via SMTP to localhost. Nevertheless, one can probably do better than
# this by adding some syscall filtering.
#NoNewPrivileges=true
+#
+# These directives automatically enable NoNewPrivileges, and are therefore
+# incompatible:
+#PrivateDevices=true
+#ProtectKernelModules=true
+#ProtectKernelTunables=true
[Install]
WantedBy=multi-user.target
More information about the inn-committers
mailing list