systemd service: Evaluate `DynamicUser=true` about eturnal HOT 4 CLOSED

But

Moreover ProtectSystem=strict and ProtectHome=read-only are implied, thus prohibiting the service to write to arbitrary file system locations.

where ProtectSystem=full currently. ProtectSystem=:

If set to "strict" the entire file system hierarchy is mounted read-only, except for the API file system subtrees /dev/, /proc/ and /sys/ (protect these directories using PrivateDevices=, ProtectKernelTunables=, ProtectControlGroups=).

from eturnal.

it might make sense to set DynamicUser= to true

We'd need to figure out how to handle the ~/.erlang.cookie file. Best solution would be to get rid of using it altogether, but there's no really nice alternative right now.

Apart from that, eturnal doesn't store any persistent data indeed, at least not yet.

ProtectSystem=strict

eturnal should work fine with strict, it's just not supported by older systemd versions, so I'm using full for compatibility with those.

from eturnal.

it might make sense to set DynamicUser= to true

We'd need to figure out how to handle the ~/.erlang.cookie file. Best solution would be to get rid of using it altogether, but there's no really nice alternative right now.

Apart from that, eturnal doesn't store any persistent data indeed, at least not yet.

Also, with LogsDirectory= removed – it is present in the upstream template –, and the log directory being part of the installation prefix, the log directory needs to be listed in ReadWritePaths=.

from eturnal.

Apart from that, eturnal doesn't store any persistent data indeed, at least not yet.

However, if we do set DynamicUser=true and then need persistent data storage later on, it might not be straightforward to revert that setting, as the systemd unit configuration isn't necessarily replaced on upgrade. Therefore, I think we should rather not apply this to the upstream unit file.

from eturnal.