From a4505978ad71336dafc03809c04951e1d4a0b32e Mon Sep 17 00:00:00 2001 From: Sunil Mohan Adapa Date: Mon, 27 Oct 2025 14:28:08 -0700 Subject: [PATCH] Enable private tmp and join namespaces for the two daemons - Earlier PrivateTmp=no is set freedombox-privileged.service in 4140d3b4444d2fd55ac682d066fd859cb2f034b5 and the fix was not properly tested. Similar change was needed in plinth.service and it was not done. - Complete the fix but this time enable private tmp and join namespaces for the two daemons. - This will cause issues with file uploading when plinth is run from command line (for development purposes). This will be addressed separately. Tests: - Apply the change and reload systemd and restart service. Don't run plinth on command line and run it as service. - Uploading libraries to kiwix works - Uploading backup tarballs works. - Uploading TiddlyWiki and Feature Wiki wiki files works. Signed-off-by: Sunil Mohan Adapa Reviewed-by: James Valleroy --- data/usr/lib/systemd/system/freedombox-privileged.service | 7 +++++-- data/usr/lib/systemd/system/plinth.service | 4 ++++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/data/usr/lib/systemd/system/freedombox-privileged.service b/data/usr/lib/systemd/system/freedombox-privileged.service index 68aaebda8..fc0827ce7 100644 --- a/data/usr/lib/systemd/system/freedombox-privileged.service +++ b/data/usr/lib/systemd/system/freedombox-privileged.service @@ -7,6 +7,8 @@ Documentation=https://wiki.debian.org/FreedomBox/ StartLimitIntervalSec=0 # Stop/restart along with .socket unit (invoked from dpkg scripts). PartOf=freedombox-privileged.socket +# Uploaded files in /var/tmp/ are shared with FreedomBox web service. +JoinsNamespaceOf=plinth.service [Service] Type=notify @@ -15,8 +17,9 @@ TimeoutSec=300s User=root Group=root NotifyAccess=main -# Uploaded files in /var/tmp/ are shared with FreedomBox web service. -#PrivateTmp=yes +# Uploaded files in /var/tmp/ are shared with FreedomBox web service by joining +# namespaces. +PrivateTmp=yes Restart=on-failure # Don't restart too fast RestartSec=1 diff --git a/data/usr/lib/systemd/system/plinth.service b/data/usr/lib/systemd/system/plinth.service index 2341b2745..85a6abda7 100644 --- a/data/usr/lib/systemd/system/plinth.service +++ b/data/usr/lib/systemd/system/plinth.service @@ -5,6 +5,8 @@ Description=FreedomBox Service (Plinth) Documentation=man:plinth(1) After=network.target StartLimitIntervalSec=0 +# Uploaded files in /var/tmp/ are shared with FreedomBox privileged service. +JoinsNamespaceOf=freedombox-privileged.service [Service] Type=notify @@ -18,6 +20,8 @@ Group=plinth StandardOutput=null StandardError=null NotifyAccess=main +# Uploaded files in /var/tmp/ are shared with FreedomBox privileged service by +# joining namespaces. PrivateTmp=yes [Install]