Re: [systemd-devel] About http://0pointer.net/blog/avoiding-cve-2016-8655-with-systemd.html

2016-12-09 Thread Topi Miettinen
On 12/09/16 00:56, Michael Biebl wrote: > Btw, I think we are lacking a good systemd sandboxing howto/tutorial. > The one linked from fdo > (http://0pointer.de/blog/projects/security.html) is pretty dated and > the systemd.exec man page is not coherent enough with regards to > security/sandboxing.

Re: [systemd-devel] systemd-timesyncd with read-only root filesystem

2016-12-09 Thread Michael Chapman
On Fri, 9 Dec 2016, André Hartmann wrote: Hi Michael, Am 09.12.2016 um 12:43 schrieb Michael Chapman: On Fri, 9 Dec 2016, Michael Chapman wrote: [...] > You will need to use the .service extension on at least the first of > those links. systemd will only consider links in that directory

Re: [systemd-devel] systemd-timesyncd with read-only root filesystem

2016-12-09 Thread André Hartmann
Hi Michael, Am 09.12.2016 um 12:43 schrieb Michael Chapman: On Fri, 9 Dec 2016, Michael Chapman wrote: [...] You will need to use the .service extension on at least the first of those links. systemd will only consider links in that directory that have valid unit names. (I'm pretty sure the

Re: [systemd-devel] systemd-timesyncd with read-only root filesystem

2016-12-09 Thread Tomasz Torcz
On Fri, Dec 09, 2016 at 10:46:51AM +0100, André Hartmann wrote: > Hi Martin, > > thanks for keeping our dialog alive :) > > To sum up again what I actually want to achive: > > I want to use NTP after bootup by default, but in case no NTP is available, > the user should be able to set the date

Re: [systemd-devel] systemd-timesyncd with read-only root filesystem

2016-12-09 Thread Michael Chapman
On Fri, 9 Dec 2016, Michael Chapman wrote: [...] Your'e right, I had a typo. But after checking again, I discovered the following: cat /etc/systemd/system/sysinit.target.wants/systemd-timesyncd (empty) But systemctl status systemd-timesyncd says active (running) The link structure is

Re: [systemd-devel] systemd-timesyncd with read-only root filesystem

2016-12-09 Thread Michael Chapman
On Fri, 9 Dec 2016, André Hartmann wrote: Hi Michael, Am 09.12.2016 um 10:25 schrieb Michael Chapman: On Thu, 8 Dec 2016, André Hartmann wrote: [...] > Which confuses me is the inconsistency between > "systemctl status systemd.timesyncd" and "timedatectl status": > > # systemctl status

[systemd-devel] using SYSTEMD_ALIAS with devices that re-appear on different sysfs path

2016-12-09 Thread Alexander 'Leo' Bergolth
Hi! I'd like to uniquely identify USB-disks according to their GTP disk UUID and assign a corresponding systemd device unit in order to be able to start/stop services based on them. However, whenever a USB device is unplugged and replugged again soon (within a few seconds), there seems to be a

Re: [systemd-devel] systemd-timesyncd with read-only root filesystem

2016-12-09 Thread André Hartmann
Hi Michael, Am 09.12.2016 um 10:25 schrieb Michael Chapman: On Thu, 8 Dec 2016, André Hartmann wrote: [...] Which confuses me is the inconsistency between "systemctl status systemd.timesyncd" and "timedatectl status": # systemctl status systemd.timesyncd * systemd.timesyncd.service

Re: [systemd-devel] systemd-timesyncd with read-only root filesystem

2016-12-09 Thread André Hartmann
Hi Martin, thanks for keeping our dialog alive :) To sum up again what I actually want to achive: I want to use NTP after bootup by default, but in case no NTP is available, the user should be able to set the date and time by hand with timedatectl. But timedatectl refuses to do so, if "NTP

Re: [systemd-devel] About http://0pointer.net/blog/avoiding-cve-2016-8655-with-systemd.html

2016-12-09 Thread Lennart Poettering
On Fri, 09.12.16 02:01, Reindl Harald (h.rei...@thelounge.net) wrote: > > > Am 09.12.2016 um 01:56 schrieb Michael Biebl: > > Btw, I think we are lacking a good systemd sandboxing howto/tutorial. > > The one linked from fdo > > (http://0pointer.de/blog/projects/security.html) is pretty dated

Re: [systemd-devel] systemd-timesyncd with read-only root filesystem

2016-12-09 Thread Michael Chapman
On Thu, 8 Dec 2016, André Hartmann wrote: [...] Which confuses me is the inconsistency between "systemctl status systemd.timesyncd" and "timedatectl status": # systemctl status systemd.timesyncd * systemd.timesyncd.service Loaded: not-found (Reason: No such file or directory) Active:

Re: [systemd-devel] systemd-timesyncd with read-only root filesystem

2016-12-09 Thread Martin Pitt
Hello André, André Hartmann [2016-12-08 9:28 +0100]: > My main problem is that I cannot disable NTP by setting > the link to /dev/null as the root partition is read-only. Well, of course you can't change the image configuration after building it -- you need to disable the service in the image