Re: [systemd-devel] how to debug failures when trying to lock down services

2017-12-01 Thread Michael Biebl
2017-11-30 18:24 GMT+01:00 Lennart Poettering : > On Do, 30.11.17 10:35, Mantas Mikulėnas (graw...@gmail.com) wrote: > >> Then I'm guessing ProtectSystem=strict overrides ReadWritePaths and makes >> /var/log read-only... > > Hmm, it does? It really shouldn't. > > I thought

Re: [systemd-devel] how to debug failures when trying to lock down services

2017-11-30 Thread Lennart Poettering
On Do, 30.11.17 10:35, Mantas Mikulėnas (graw...@gmail.com) wrote: > Then I'm guessing ProtectSystem=strict overrides ReadWritePaths and makes > /var/log read-only... Hmm, it does? It really shouldn't. I thought the issues were mostly around InaccessiblePaths= not permitting exclusions, not

Re: [systemd-devel] how to debug failures when trying to lock down services

2017-11-30 Thread Michael Biebl
2017-11-30 16:07 GMT+01:00 Michael Biebl : > 2017-11-30 9:35 GMT+01:00 Mantas Mikulėnas : >> On Thu, Nov 30, 2017 at 10:31 AM, Michael Biebl wrote: >>> >>> 2017-11-30 6:52 GMT+01:00 Mantas Mikulėnas : >>> > On Thu, Nov 30,

Re: [systemd-devel] how to debug failures when trying to lock down services

2017-11-30 Thread Mantas Mikulėnas
On Thu, Nov 30, 2017 at 10:31 AM, Michael Biebl wrote: > 2017-11-30 6:52 GMT+01:00 Mantas Mikulėnas : > > On Thu, Nov 30, 2017 at 5:27 AM, Michael Biebl wrote: > >> > >> Hi, > >> > >> today I tried to lock down the rsyslog.service that I

Re: [systemd-devel] how to debug failures when trying to lock down services

2017-11-30 Thread Michael Biebl
2017-11-30 6:52 GMT+01:00 Mantas Mikulėnas : > On Thu, Nov 30, 2017 at 5:27 AM, Michael Biebl wrote: >> >> Hi, >> >> today I tried to lock down the rsyslog.service that I have on my system. >> >> For that I first created an override.conf that contained >> >>

Re: [systemd-devel] how to debug failures when trying to lock down services

2017-11-29 Thread Mantas Mikulėnas
On Thu, Nov 30, 2017 at 5:27 AM, Michael Biebl wrote: > Hi, > > today I tried to lock down the rsyslog.service that I have on my system. > > For that I first created an override.conf that contained > > [Service] > ProtectHome=yes > PrivateTmp=yes > PrivateDevices=yes > >

[systemd-devel] how to debug failures when trying to lock down services

2017-11-29 Thread Michael Biebl
Hi, today I tried to lock down the rsyslog.service that I have on my system. For that I first created an override.conf that contained [Service] ProtectHome=yes PrivateTmp=yes PrivateDevices=yes ProtectSystem=strict ReadWritePaths=/var/log ReadWritePaths=/var/spool/rsyslog