rothmanandClaude Opus 5.5
1eabb839d3
ProtectKernelTunables, ProtectKernelModules and LockPersonality imply NoNewPrivileges for a non-root unit, so sudo refused to start the helper (hostname, reboot, network changes all failed). Guarded by a test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
32 lines
1.1 KiB
Desktop File
32 lines
1.1 KiB
Desktop File
[Unit]
|
|
Description=VoxIP Kiosk Manager (webbeheer)
|
|
Documentation=file:///usr/share/doc/voxip-kiosk/README.md
|
|
After=network.target voxip-boot-import.service
|
|
StartLimitIntervalSec=300
|
|
StartLimitBurst=10
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=voxip
|
|
Group=voxip
|
|
# systemd-journal: read logs; video: vcgencmd (voltage/throttling)
|
|
SupplementaryGroups=systemd-journal video
|
|
ExecStart=/usr/lib/voxip-kiosk/voxip-kiosk-manager
|
|
Restart=always
|
|
RestartSec=3
|
|
UMask=0027
|
|
LogsDirectory=voxip-kiosk
|
|
LogsDirectoryMode=0750
|
|
SyslogIdentifier=voxip-kiosk-manager
|
|
# No NoNewPrivileges/ProtectSystem/ProtectHome: the helper started through
|
|
# "sudo -n voxip-kiosk-helper" inherits this unit's mount namespace and must
|
|
# be able to write /etc (hostname, NetworkManager profiles). The web process
|
|
# itself runs unprivileged as user voxip and can only write its own dirs.
|
|
# Also no ProtectKernelTunables/ProtectKernelModules/LockPersonality,
|
|
# RestrictSUIDSGID, SystemCall*, ...: for a non-root unit those imply
|
|
# NoNewPrivileges, and sudo then refuses to run (tests/test_units.py).
|
|
ProtectControlGroups=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|