From 861a1cec60e202a2a2d17fd61bbfae0264168115 Mon Sep 17 00:00:00 2001 From: aszlig Date: Wed, 27 Mar 2019 20:16:44 +0100 Subject: nixos/confinement: Remove handling for StartOnly Noted by @Infinisil on IRC: infinisil: Question regarding the confinement PR infinisil: On line 136 you do different things depending on RootDirectoryStartOnly infinisil: But on line 157 you have an assertion that disallows that option being true infinisil: Is there a reason behind this or am I missing something I originally left this in so that once systemd supports that, we can just flip a switch and remove the assertion and thus support RootDirectoryStartOnly for our confinement module. However, this doesn't seem to be on the roadmap for systemd in the foreseeable future, so I'll just remove this, especially because it's very easy to add it again, once it is supported. Signed-off-by: aszlig --- nixos/modules/security/systemd-confinement.nix | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) (limited to 'nixos') diff --git a/nixos/modules/security/systemd-confinement.nix b/nixos/modules/security/systemd-confinement.nix index 49fde2dcc6d5..31b07b1b03d2 100644 --- a/nixos/modules/security/systemd-confinement.nix +++ b/nixos/modules/security/systemd-confinement.nix @@ -52,11 +52,7 @@ in { dependencies of this systemd unit, you can use . - Only the latter - (${mkScOption "ExecStart"}) will be used if - ${mkScOption "RootDirectoryStartOnly"} is enabled. - - Also, the store paths listed in are + The store paths listed in are not included in the closure as well as paths from other options except those listed above. @@ -133,8 +129,7 @@ in { ProtectKernelTunables = wantsAPIVFS; }; confinement.packages = let - startOnly = config.serviceConfig.RootDirectoryStartOnly or false; - execOpts = if startOnly then [ "ExecStart" ] else [ + execOpts = [ "ExecReload" "ExecStart" "ExecStartPost" "ExecStartPre" "ExecStop" "ExecStopPost" ]; -- cgit 1.4.1