diff --git a/data/usr/lib/systemd/system/freedombox-privileged.service b/data/usr/lib/systemd/system/freedombox-privileged.service index 68aaebda8..fc0827ce7 100644 --- a/data/usr/lib/systemd/system/freedombox-privileged.service +++ b/data/usr/lib/systemd/system/freedombox-privileged.service @@ -7,6 +7,8 @@ Documentation=https://wiki.debian.org/FreedomBox/ StartLimitIntervalSec=0 # Stop/restart along with .socket unit (invoked from dpkg scripts). PartOf=freedombox-privileged.socket +# Uploaded files in /var/tmp/ are shared with FreedomBox web service. +JoinsNamespaceOf=plinth.service [Service] Type=notify @@ -15,8 +17,9 @@ TimeoutSec=300s User=root Group=root NotifyAccess=main -# Uploaded files in /var/tmp/ are shared with FreedomBox web service. -#PrivateTmp=yes +# Uploaded files in /var/tmp/ are shared with FreedomBox web service by joining +# namespaces. +PrivateTmp=yes Restart=on-failure # Don't restart too fast RestartSec=1 diff --git a/data/usr/lib/systemd/system/plinth.service b/data/usr/lib/systemd/system/plinth.service index 2341b2745..85a6abda7 100644 --- a/data/usr/lib/systemd/system/plinth.service +++ b/data/usr/lib/systemd/system/plinth.service @@ -5,6 +5,8 @@ Description=FreedomBox Service (Plinth) Documentation=man:plinth(1) After=network.target StartLimitIntervalSec=0 +# Uploaded files in /var/tmp/ are shared with FreedomBox privileged service. +JoinsNamespaceOf=freedombox-privileged.service [Service] Type=notify @@ -18,6 +20,8 @@ Group=plinth StandardOutput=null StandardError=null NotifyAccess=main +# Uploaded files in /var/tmp/ are shared with FreedomBox privileged service by +# joining namespaces. PrivateTmp=yes [Install]