abrown38andClaude Opus 5.5
cf49df0346
jarld also listens on /run/jarl/jarl.sock (socket in jarl.yaml). Requests on it from root or jarld's own user need no token and act as an administrator; the kernel's SO_PEERCRED says who is connecting, and anyone else must send a token. The jarl CLI uses the socket when no server is configured, or with -s local, so 'sudo jarl status' works on the server with nothing set up and a lost token or password never locks root out. Changes are audited under the system user's name via "socket". The systemd unit creates /run/jarl (0750). Socket paths over 107 bytes are refused with a clear message. The docs explain the socket and what happens when a token is revoked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
64 lines
1.8 KiB
Desktop File
64 lines
1.8 KiB
Desktop File
# Jarl daemon: web UI and REST API for managing BIND.
|
|
# Installed as /etc/systemd/system/jarl.service (see docs/install.md).
|
|
[Unit]
|
|
Description=Jarl BIND manager (web UI and API)
|
|
Documentation=file:///usr/local/share/doc/jarl/README.md
|
|
After=network-online.target named.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=notify
|
|
NotifyAccess=main
|
|
ExecStart=/usr/local/bin/jarld --config /etc/jarl/jarl.yaml serve
|
|
# SIGHUP rereads the TLS certificate.
|
|
ExecReload=/bin/kill -HUP $MAINPID
|
|
Restart=on-failure
|
|
RestartSec=5s
|
|
|
|
User=jarl
|
|
Group=jarl
|
|
# Membership of 'bind' lets jarld read /etc/bind/rndc.key and the rest of
|
|
# named's configuration (for rndc and named-checkconf) and give generated
|
|
# files to group bind so named can read them.
|
|
SupplementaryGroups=bind
|
|
UMask=0027
|
|
|
|
# /var/lib/jarl: database and staging area.
|
|
StateDirectory=jarl
|
|
StateDirectoryMode=0750
|
|
ConfigurationDirectory=jarl
|
|
ConfigurationDirectoryMode=0750
|
|
# /run/jarl: the local API socket (jarl.sock), for root and the jarl user.
|
|
RuntimeDirectory=jarl
|
|
RuntimeDirectoryMode=0750
|
|
|
|
# Sandboxing. jarld may only write its own state and the directories it
|
|
# manages for named (created by tmpfiles.d/jarl.conf).
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/etc/bind/jarl /var/lib/bind/jarl /var/cache/bind/jarl
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
NoNewPrivileges=yes
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectControlGroups=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
SystemCallArchitectures=native
|
|
# @system-service includes @chown, which jarld needs to give files to group bind.
|
|
SystemCallFilter=@system-service
|
|
SystemCallErrorNumber=EPERM
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|