nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-08-19 12:36:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enable private tmp and join namespaces for the two daemons

Browse Source 
- Earlier PrivateTmp=no is set freedombox-privileged.service in
4140d3b4444d2fd55ac682d066fd859cb2f034b5 and the fix was not properly tested.
Similar change was needed in plinth.service and it was not done.

- Complete the fix but this time enable private tmp and join namespaces for the
two daemons.

- This will cause issues with file uploading when plinth is run from command
line (for development purposes). This will be addressed separately.

Tests:

- Apply the change and reload systemd and restart service. Don't run plinth on
command line and run it as service.

  - Uploading libraries to kiwix works

  - Uploading backup tarballs works.

  - Uploading TiddlyWiki and Feature Wiki wiki files works.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
This commit is contained in:
Sunil Mohan Adapa 2025-10-27 14:28:08 -07:00 committed by James Valleroy
parent 949ab18486
commit a4505978ad
No known key found for this signature in database
GPG Key ID: 77C0C75E7B650808
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
data/usr/lib/systemd/system/freedombox-privileged.service
View File

@ -7,6 +7,8 @@ Documentation=https://wiki.debian.org/FreedomBox/
StartLimitIntervalSec=0
# Stop/restart along with .socket unit (invoked from dpkg scripts).
PartOf=freedombox-privileged.socket
# Uploaded files in /var/tmp/ are shared with FreedomBox web service.
JoinsNamespaceOf=plinth.service
[Service]
Type=notify
@ -15,8 +17,9 @@ TimeoutSec=300s
User=root
Group=root
NotifyAccess=main
# Uploaded files in /var/tmp/ are shared with FreedomBox web service.
#PrivateTmp=yes
# Uploaded files in /var/tmp/ are shared with FreedomBox web service by joining
# namespaces.
PrivateTmp=yes
Restart=on-failure
# Don't restart too fast
RestartSec=1

4
data/usr/lib/systemd/system/plinth.service
View File

@ -5,6 +5,8 @@ Description=FreedomBox Service (Plinth)
Documentation=man:plinth(1)
After=network.target
StartLimitIntervalSec=0
# Uploaded files in /var/tmp/ are shared with FreedomBox privileged service.
JoinsNamespaceOf=freedombox-privileged.service
[Service]
Type=notify
@ -18,6 +20,8 @@ Group=plinth
StandardOutput=null
StandardError=null
NotifyAccess=main
# Uploaded files in /var/tmp/ are shared with FreedomBox privileged service by
# joining namespaces.
PrivateTmp=yes
[Install]