54 lines
1.5 KiB
SYSTEMD
54 lines
1.5 KiB
SYSTEMD
|
# Souveraine machine identity — SYSTEM unit (contrast souveraine.service,
|
||
|
|
# which is a user unit). Runs from boot, before any human authenticates;
|
||
|
|
# owns the machine seed and serves signatures over a Unix socket.
|
||
|
|
#
|
||
|
|
# Access control is the socket: /run/souveraine (0750 souveraine:souveraine)
|
||
|
|
# + machined.sock (0660). Add session users to the `souveraine` group:
|
||
|
|
# usermod -aG souveraine <user>
|
||
|
|
#
|
||
|
|
# Provision the seed before first start:
|
||
|
|
# sudo souveraine machine init --fresh
|
||
|
|
# sudo souveraine machine init --migrate-from /home/<user>/.souveraine/seed-id
|
||
|
|
[Unit]
|
||
|
|
Description=Souveraine machine identity (system tier)
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
User=souveraine
|
||
|
|
Group=souveraine
|
||
|
|
ExecStart=/usr/bin/souveraine-machined
|
||
|
|
Restart=on-failure
|
||
|
|
RestartSec=5
|
||
|
|
|
||
|
|
# /var/lib/souveraine — the seed. /run/souveraine — the socket.
|
||
|
|
StateDirectory=souveraine
|
||
|
|
StateDirectoryMode=0700
|
||
|
|
RuntimeDirectory=souveraine
|
||
|
|
RuntimeDirectoryMode=0750
|
||
|
|
UMask=0007
|
||
|
|
|
||
|
|
# Network-less signer, RedFlag-executor posture: nothing to reach, nothing
|
||
|
|
# reachable. AF_UNIX only, no privileges, no writable system.
|
||
|
|
NoNewPrivileges=yes
|
||
|
|
CapabilityBoundingSet=
|
||
|
|
RestrictAddressFamilies=AF_UNIX
|
||
|
|
IPAddressDeny=any
|
||
|
|
ProtectSystem=strict
|
||
|
|
ProtectHome=yes
|
||
|
|
PrivateTmp=yes
|
||
|
|
PrivateDevices=yes
|
||
|
|
ProtectKernelTunables=yes
|
||
|
|
ProtectKernelModules=yes
|
||
|
|
ProtectControlGroups=yes
|
||
|
|
ProtectClock=yes
|
||
|
|
ProtectHostname=yes
|
||
|
|
LockPersonality=yes
|
||
|
|
MemoryDenyWriteExecute=yes
|
||
|
|
RestrictRealtime=yes
|
||
|
|
RestrictNamespaces=yes
|
||
|
|
RestrictSUIDSGID=yes
|
||
|
|
SystemCallArchitectures=native
|
||
|
|
SystemCallFilter=@system-service
|
||
|
|
SystemCallErrorNumber=EPERM
|
||
|
|
|
||
|
|
[Install]
|
||
|
|
WantedBy=multi-user.target
|