summaryrefslogtreecommitdiffstats
path: root/tmpfiles.d
diff options
context:
space:
mode:
Diffstat (limited to 'tmpfiles.d')
-rw-r--r--tmpfiles.d/etc.conf.m422
-rw-r--r--tmpfiles.d/home.conf11
-rw-r--r--tmpfiles.d/journal-nocow.conf27
-rw-r--r--tmpfiles.d/legacy.conf27
-rw-r--r--tmpfiles.d/meson.build53
-rw-r--r--tmpfiles.d/portables.conf4
-rw-r--r--tmpfiles.d/systemd-nologin.conf11
-rw-r--r--tmpfiles.d/systemd-nspawn.conf23
-rw-r--r--tmpfiles.d/systemd.conf.m477
-rw-r--r--tmpfiles.d/tmp.conf22
-rw-r--r--tmpfiles.d/var.conf.m425
-rw-r--r--tmpfiles.d/x11.conf19
12 files changed, 321 insertions, 0 deletions
diff --git a/tmpfiles.d/etc.conf.m4 b/tmpfiles.d/etc.conf.m4
new file mode 100644
index 0000000..df8d421
--- /dev/null
+++ b/tmpfiles.d/etc.conf.m4
@@ -0,0 +1,22 @@
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+L /etc/os-release - - - - ../usr/lib/os-release
+L /etc/localtime - - - - ../usr/share/zoneinfo/UTC
+L+ /etc/mtab - - - - ../proc/self/mounts
+m4_ifdef(`HAVE_SMACK_RUN_LABEL',
+t /etc/mtab - - - - security.SMACK64=_
+)m4_dnl
+m4_ifdef(`ENABLE_RESOLVE',
+L! /etc/resolv.conf - - - - ../run/systemd/resolve/stub-resolv.conf
+)m4_dnl
+C /etc/nsswitch.conf - - - -
+m4_ifdef(`HAVE_PAM',
+C /etc/pam.d - - - -
+)m4_dnl
diff --git a/tmpfiles.d/home.conf b/tmpfiles.d/home.conf
new file mode 100644
index 0000000..9f25b83
--- /dev/null
+++ b/tmpfiles.d/home.conf
@@ -0,0 +1,11 @@
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+Q /home 0755 - - -
+q /srv 0755 - - -
diff --git a/tmpfiles.d/journal-nocow.conf b/tmpfiles.d/journal-nocow.conf
new file mode 100644
index 0000000..e32a388
--- /dev/null
+++ b/tmpfiles.d/journal-nocow.conf
@@ -0,0 +1,27 @@
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+# Set the NOCOW attribute for directories of journal files. This flag
+# is inherited by their new files and sub-directories. Matters only
+# for btrfs filesystems.
+#
+# WARNING: Enabling the NOCOW attribute improves journal performance
+# substantially, but also disables the btrfs checksum logic. In
+# btrfs RAID filesystems the checksums are needed for rebuilding
+# corrupted files. Without checksums such rebuilds are not
+# possible.
+#
+# In a single-disk filesystem (or a filesystem without redundancy)
+# enabling the NOCOW attribute for journal files is safe, because
+# they have their own checksums and a rebuilding wouldn't be possible
+# in any case.
+
+h /var/log/journal - - - - +C
+h /var/log/journal/%m - - - - +C
+h /var/log/journal/remote - - - - +C
diff --git a/tmpfiles.d/legacy.conf b/tmpfiles.d/legacy.conf
new file mode 100644
index 0000000..62e2ae0
--- /dev/null
+++ b/tmpfiles.d/legacy.conf
@@ -0,0 +1,27 @@
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+# These files are considered legacy and are unnecessary on legacy-free
+# systems.
+
+d /run/lock 0755 root root -
+L /var/lock - - - - ../run/lock
+
+# /run/lock/subsys is used for serializing SysV service execution, and
+# hence without use on SysV-less systems.
+
+d /run/lock/subsys 0755 root root -
+
+# /forcefsck, /fastboot and /forcequotacheck are deprecated in favor of the
+# kernel command line options 'fsck.mode=force', 'fsck.mode=skip' and
+# 'quotacheck.mode=force'
+
+r! /forcefsck
+r! /fastboot
+r! /forcequotacheck
diff --git a/tmpfiles.d/meson.build b/tmpfiles.d/meson.build
new file mode 100644
index 0000000..35eea2b
--- /dev/null
+++ b/tmpfiles.d/meson.build
@@ -0,0 +1,53 @@
+# SPDX-License-Identifier: LGPL-2.1+
+
+enable_tmpfiles = conf.get('ENABLE_TMPFILES') == 1
+
+tmpfiles = [['home.conf', ''],
+ ['journal-nocow.conf', ''],
+ ['systemd-nologin.conf', ''],
+ ['systemd-nspawn.conf', 'ENABLE_MACHINED'],
+ ['portables.conf', 'ENABLE_PORTABLED'],
+ ['tmp.conf', ''],
+ ['x11.conf', ''],
+ ['legacy.conf', 'HAVE_SYSV_COMPAT'],
+ ]
+
+foreach pair : tmpfiles
+ if not enable_tmpfiles
+ # do nothing
+ elif pair[1] == '' or conf.get(pair[1]) == 1
+ install_data(pair[0], install_dir : tmpfilesdir)
+ else
+ message('Not installing tmpfiles.d/@0@ because @1@ is @2@'
+ .format(pair[0], pair[1], conf.get(pair[1], 0)))
+ endif
+endforeach
+
+m4_files = [['etc.conf', ''],
+ ['systemd.conf', ''],
+ ['var.conf', ''],
+ ]
+
+foreach pair : m4_files
+ if not enable_tmpfiles
+ # do nothing
+ elif pair[1] == '' or conf.get(pair[1]) == 1
+ custom_target(
+ 'tmpfiles.d_' + pair[0],
+ input : pair[0] + '.m4',
+ output: pair[0],
+ command : [meson_apply_m4, config_h, '@INPUT@'],
+ capture : true,
+ install : true,
+ install_dir : tmpfilesdir)
+ else
+ message('Not installing tmpfiles.d/@0@.m4 because @1@ is @2@'
+ .format(pair[0], pair[1], conf.get(pair[1], 0)))
+ endif
+endforeach
+
+if enable_tmpfiles
+ meson.add_install_script(
+ 'sh', '-c',
+ mkdir_p.format(join_paths(sysconfdir, 'tmpfiles.d')))
+endif
diff --git a/tmpfiles.d/portables.conf b/tmpfiles.d/portables.conf
new file mode 100644
index 0000000..b8ddf7f
--- /dev/null
+++ b/tmpfiles.d/portables.conf
@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: LGPL-2.1+
+# See tmpfiles.d(5) for details
+
+Q /var/lib/portables 0700
diff --git a/tmpfiles.d/systemd-nologin.conf b/tmpfiles.d/systemd-nologin.conf
new file mode 100644
index 0000000..df4dd63
--- /dev/null
+++ b/tmpfiles.d/systemd-nologin.conf
@@ -0,0 +1,11 @@
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+
+# See tmpfiles.d(5), systemd-user-session.service(5) and pam_nologin(8).
+# This file has special suffix so it is not run by mistake.
+
+F! /run/nologin 0644 - - - "System is booting up. Unprivileged users are not permitted to log in yet. Please come back later. For technical details, see pam_nologin(8)."
diff --git a/tmpfiles.d/systemd-nspawn.conf b/tmpfiles.d/systemd-nspawn.conf
new file mode 100644
index 0000000..78bd1c6
--- /dev/null
+++ b/tmpfiles.d/systemd-nspawn.conf
@@ -0,0 +1,23 @@
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+Q /var/lib/machines 0700 - - -
+
+# Remove old temporary snapshots, but only at boot. Ideally we'd have
+# "self-destroying" btrfs snapshots that go away if the last
+# reference to it does. To mimic a scheme like this at least remove
+# the old snapshots on fresh boots, where we know they cannot be
+# referenced anymore. Note that we actually remove all temporary files
+# in /var/lib/machines/ at boot, which should be safe since the
+# directory has defined semantics. In the root directory (where
+# systemd-nspawn --ephemeral places snapshots) we are more strict, to
+# avoid removing unrelated temporary files.
+
+R! /var/lib/machines/.#*
+R! /.#machine.*
diff --git a/tmpfiles.d/systemd.conf.m4 b/tmpfiles.d/systemd.conf.m4
new file mode 100644
index 0000000..d39c9cb
--- /dev/null
+++ b/tmpfiles.d/systemd.conf.m4
@@ -0,0 +1,77 @@
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+d /run/user 0755 root root -
+F! /run/utmp 0664 root utmp -
+
+d /run/systemd/ask-password 0755 root root -
+d /run/systemd/seats 0755 root root -
+d /run/systemd/sessions 0755 root root -
+d /run/systemd/users 0755 root root -
+d /run/systemd/machines 0755 root root -
+d /run/systemd/shutdown 0755 root root -
+m4_ifdef(`ENABLE_NETWORKD',
+d /run/systemd/netif 0755 systemd-network systemd-network -
+d /run/systemd/netif/links 0755 systemd-network systemd-network -
+d /run/systemd/netif/leases 0755 systemd-network systemd-network -
+)m4_dnl
+
+d /run/log 0755 root root -
+
+z /run/log/journal 2755 root systemd-journal - -
+Z /run/log/journal/%m ~2750 root systemd-journal - -
+m4_ifdef(`HAVE_ACL',`m4_dnl
+m4_ifdef(`ENABLE_ADM_GROUP',`m4_dnl
+m4_ifdef(`ENABLE_WHEEL_GROUP',``
+a+ /run/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x
+a+ /run/log/journal/%m - - - - group:adm:r-x,group:wheel:r-x
+a+ /run/log/journal/%m/*.journal* - - - - group:adm:r--,group:wheel:r--
+'',``
+a+ /run/log/journal/%m - - - - d:group:adm:r-x
+a+ /run/log/journal/%m - - - - group:adm:r-x
+a+ /run/log/journal/%m/*.journal* - - - - group:adm:r--
+'')',`m4_dnl
+m4_ifdef(`ENABLE_WHEEL_GROUP',``
+a+ /run/log/journal/%m - - - - d:group:wheel:r-x
+a+ /run/log/journal/%m - - - - group:wheel:r-x
+a+ /run/log/journal/%m/*.journal* - - - - group:wheel:r--
+'')')')m4_dnl
+
+z /var/log/journal 2755 root systemd-journal - -
+z /var/log/journal/%m 2755 root systemd-journal - -
+z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
+m4_ifdef(`HAVE_ACL',`m4_dnl
+m4_ifdef(`ENABLE_ADM_GROUP',`m4_dnl
+m4_ifdef(`ENABLE_WHEEL_GROUP',``
+a+ /var/log/journal - - - - d:group::r-x,d:group:adm:r-x,d:group:wheel:r-x
+a+ /var/log/journal - - - - group::r-x,group:adm:r-x,group:wheel:r-x
+a+ /var/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x
+a+ /var/log/journal/%m - - - - group:adm:r-x,group:wheel:r-x
+a+ /var/log/journal/%m/system.journal - - - - group:adm:r--,group:wheel:r--
+'', ``
+a+ /var/log/journal - - - - d:group::r-x,d:group:adm:r-x
+a+ /var/log/journal - - - - group::r-x,group:adm:r-x
+a+ /var/log/journal/%m - - - - d:group:adm:r-x
+a+ /var/log/journal/%m - - - - group:adm:r-x
+a+ /var/log/journal/%m/system.journal - - - - group:adm:r--
+'')',`m4_dnl
+m4_ifdef(`ENABLE_WHEEL_GROUP',``
+a+ /var/log/journal - - - - d:group::r-x,d:group:wheel:r-x
+a+ /var/log/journal - - - - group::r-x,group:wheel:r-x
+a+ /var/log/journal/%m - - - - d:group:wheel:r-x
+a+ /var/log/journal/%m - - - - group:wheel:r-x
+a+ /var/log/journal/%m/system.journal - - - - group:wheel:r--
+'')')')m4_dnl
+
+d /var/lib/systemd 0755 root root -
+d /var/lib/systemd/coredump 0755 root root 3d
+
+d /var/lib/private 0700 root root -
+d /var/log/private 0700 root root -
+d /var/cache/private 0700 root root -
diff --git a/tmpfiles.d/tmp.conf b/tmpfiles.d/tmp.conf
new file mode 100644
index 0000000..22555a0
--- /dev/null
+++ b/tmpfiles.d/tmp.conf
@@ -0,0 +1,22 @@
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+# Clear tmp directories separately, to make them easier to override
+q /tmp 1777 root root 10d
+q /var/tmp 1777 root root 30d
+
+# Exclude namespace mountpoints created with PrivateTmp=yes
+x /tmp/systemd-private-%b-*
+X /tmp/systemd-private-%b-*/tmp
+x /var/tmp/systemd-private-%b-*
+X /var/tmp/systemd-private-%b-*/tmp
+
+# Remove top-level private temporary directories on each boot
+R! /tmp/systemd-private-*
+R! /var/tmp/systemd-private-*
diff --git a/tmpfiles.d/var.conf.m4 b/tmpfiles.d/var.conf.m4
new file mode 100644
index 0000000..0e2c509
--- /dev/null
+++ b/tmpfiles.d/var.conf.m4
@@ -0,0 +1,25 @@
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+q /var 0755 - - -
+
+L /var/run - - - - ../run
+
+d /var/log 0755 - - -
+m4_ifdef(`ENABLE_UTMP',
+f /var/log/wtmp 0664 root utmp -
+f /var/log/btmp 0660 root utmp -
+f /var/log/lastlog 0664 root utmp -
+)m4_dnl
+
+d /var/cache 0755 - - -
+
+d /var/lib 0755 - - -
+
+d /var/spool 0755 - - -
diff --git a/tmpfiles.d/x11.conf b/tmpfiles.d/x11.conf
new file mode 100644
index 0000000..f63184e
--- /dev/null
+++ b/tmpfiles.d/x11.conf
@@ -0,0 +1,19 @@
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+
+# See tmpfiles.d(5) for details
+
+# Make sure these are created by default so that nobody else can
+# or empty them at startup
+D! /tmp/.X11-unix 1777 root root 10d
+D! /tmp/.ICE-unix 1777 root root 10d
+D! /tmp/.XIM-unix 1777 root root 10d
+D! /tmp/.font-unix 1777 root root 10d
+D! /tmp/.Test-unix 1777 root root 10d
+
+# Unlink the X11 lock files
+r! /tmp/.X[0-9]*-lock
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-15 04:35:33 +0000