diff options
| author | Carl Dong <accounts@carldong.me> | 2019-01-03 21:53:51 +0800 |
|---|---|---|
| committer | Carl Dong <accounts@carldong.me> | 2019-01-05 13:21:44 +0800 |
| commit | b0c7b54d0c2e116d61e686b1adfdea6a1f7f02fe (patch) | |
| tree | 7ac03b7eaf06ec68770c2d32a73a5be1be05d358 | |
| parent | fe5a70b9fefa0548f497a749746f53f3d7fd0ebb (diff) | |
init: Use systemd automatic directory creation
Tell systemd to create, set, and ensure the right mode for the PID,
configuration, and data directories.
Only the exec bit is set for groups for the aforementioned directories.
This is the least privilege perm that allows for the
reading/writing/execing of files under the directory _if_ the files
themselves give permission to its group to do so (e.g. when -sysperms is
specified). Note that this does not allow for the listing of files under
the directory.
| -rw-r--r-- | contrib/init/bitcoind.service | 34 |
1 files changed, 29 insertions, 5 deletions
diff --git a/contrib/init/bitcoind.service b/contrib/init/bitcoind.service index 877abafd19..cfc5f77580 100644 --- a/contrib/init/bitcoind.service +++ b/contrib/init/bitcoind.service @@ -5,21 +5,45 @@ # See "man systemd.service" for details. # Note that almost all daemon options could be specified in -# /etc/bitcoin/bitcoin.conf +# /etc/bitcoin/bitcoin.conf, except for those explicitly specified as arguments +# in ExecStart= [Unit] Description=Bitcoin daemon After=network.target [Service] -ExecStart=/usr/bin/bitcoind -daemon -conf=/etc/bitcoin/bitcoin.conf -pid=/run/bitcoind/bitcoind.pid -# Creates /run/bitcoind owned by bitcoin -RuntimeDirectory=bitcoind -User=bitcoin +ExecStart=/usr/bin/bitcoind -daemon \ + -pid=/run/bitcoind/bitcoind.pid \ + -conf=/etc/bitcoin/bitcoin.conf \ + -datadir=/var/lib/bitcoind + +# Process management +#################### + Type=forking PIDFile=/run/bitcoind/bitcoind.pid Restart=on-failure +# Directory creation and permissions +#################################### + +# Run as bitcoin:bitcoin +User=bitcoin +Group=bitcoin + +# /run/bitcoind +RuntimeDirectory=bitcoind +RuntimeDirectoryMode=0710 + +# /etc/bitcoin +ConfigurationDirectory=bitcoin +ConfigurationDirectoryMode=0710 + +# /var/lib/bitcoind +StateDirectory=bitcoind +StateDirectoryMode=0710 + # Hardening measures #################### |