tailscale/cmd/tailscaled/tailscaled.service

[Unit]
Description=Tailscale node agent
Documentation=https://tailscale.com/kb/
Wants=network-pre.target
After=network-pre.target

[Service]
EnvironmentFile=/etc/default/tailscaled
ExecStartPre=/usr/sbin/tailscaled --cleanup
ExecStart=/usr/sbin/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/run/tailscale/tailscaled.sock --port $PORT $FLAGS
ExecStopPost=/usr/sbin/tailscaled --cleanup

Restart=on-failure

RuntimeDirectory=tailscale
RuntimeDirectoryMode=0755
StateDirectory=tailscale
StateDirectoryMode=0750
CacheDirectory=tailscale
CacheDirectoryMode=0750
Type=notify

DeviceAllow=/dev/net/tun
DeviceAllow=/dev/null
DeviceAllow=/dev/random
DeviceAllow=/dev/urandom
DevicePolicy=strict
LockPersonality=true
MemoryDenyWriteExecute=true
PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectKernelTunables=true
ProtectSystem=strict
ReadWritePaths=/etc/
RestrictSUIDSGID=true
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target
tailscaled: add a systemd unit. Signed-off-by: David Anderson <dave@natulte.net> 5 years ago			`[Unit]`
			`Description=Tailscale node agent`
			`Documentation=https://tailscale.com/kb/`
			`Wants=network-pre.target`
			`After=network-pre.target`

			`[Service]`
			`EnvironmentFile=/etc/default/tailscaled`
tailscaled.service: also cleanup prior to starting. Fixes #813. Signed-off-by: David Anderson <danderson@tailscale.com> 4 years ago			`ExecStartPre=/usr/sbin/tailscaled --cleanup`
tailscaled: fix systemd unit definition. Port number has to be by itself for substitution to work. Disabling the restart rate-limiting has to be in [Unit] not [Service]. Signed-off-by: David Anderson <dave@natulte.net> 5 years ago			`ExecStart=/usr/sbin/tailscaled --state=/var/lib/tailscale/tailscaled.state --socket=/run/tailscale/tailscaled.sock --port $PORT $FLAGS`
cmd/tailscaled: graceful shutdown (#534) Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com> 4 years ago			`ExecStopPost=/usr/sbin/tailscaled --cleanup`
tailscaled: add a systemd unit. Signed-off-by: David Anderson <dave@natulte.net> 5 years ago
			`Restart=on-failure`

			`RuntimeDirectory=tailscale`
			`RuntimeDirectoryMode=0755`
			`StateDirectory=tailscale`
			`StateDirectoryMode=0750`
cmd/tailscaled: set CacheDirectory in service. Signed-off-by: David Anderson <dave@natulte.net> 5 years ago			`CacheDirectory=tailscale`
			`CacheDirectoryMode=0750`
ipn/ipnserver: enable systemd-notify support Addresses #964 Still to be done: - Figure out the correct logging lines in util/systemd - Figure out if we need to slip the systemd.Status function anywhere else - Log util/systemd errors? (most of the errors are of the "you cannot do anything about this, but it might be a bad idea to crash the program if it errors" kind) Assistance in getting this over the finish line would help a lot. Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: rename the nonlinux file to appease the magic Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix package name Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: fix review feedback from @mdlayher Signed-off-by: Christine Dodrill <me@christine.website> cmd/tailscale{,d}: update depaware manifests Signed-off-by: Christine Dodrill <me@christine.website> util/systemd: use sync.Once instead of func init Signed-off-by: Christine Dodrill <me@christine.website> control/controlclient: minor review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> {control,ipn,systemd}: fix review feedback Signed-off-by: Christine Dodrill <me@christine.website> review feedback fixes Signed-off-by: Christine Dodrill <me@christine.website> ipn: fix sprintf call Signed-off-by: Christine Dodrill <me@christine.website> ipn: make staticcheck less sad Signed-off-by: Christine Dodrill <me@christine.website> ipn: print IP address in connected status Signed-off-by: Christine Dodrill <me@christine.website> ipn: review feedback Signed-off-by: Christine Dodrill <me@christine.website> final fixups Signed-off-by: Christine Dodrill <me@christine.website> 4 years ago			`Type=notify`
tailscaled: add a systemd unit. Signed-off-by: David Anderson <dave@natulte.net> 5 years ago
tailscaled.service: Lock down clock and /dev (#1071) Research in issue #1063 uncovered why tailscaled would fail with ProtectClock enabled (it implicitly enabled DevicePolicy=closed). This knowledge in turn also opens the door for locking down /dev further, e.g. explicitly setting DevicePolicy=strict (instead of closed), and making /dev private for the unit. Additional possible future (or downstream) lockdown that can be done is setting `PrivateDevices=true` (with `BindPaths=/dev/net/`), however, systemd 233 or later is required for this, and tailscaled currently need to work for systemd down to version 215. Closes https://github.com/tailscale/tailscale/issues/1063 Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com> 4 years ago			`DeviceAllow=/dev/net/tun`
			`DeviceAllow=/dev/null`
			`DeviceAllow=/dev/random`
			`DeviceAllow=/dev/urandom`
			`DevicePolicy=strict`
tailscaled.service: Harden systemd unit somewhat (#1062) While not a full capability lockdown of the systemd unit, this still improves sandboxing and security of the running process a good deal. Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com> 4 years ago			`LockPersonality=true`
			`MemoryDenyWriteExecute=true`
			`PrivateTmp=true`
tailscaled.service: Lock down clock and /dev (#1071) Research in issue #1063 uncovered why tailscaled would fail with ProtectClock enabled (it implicitly enabled DevicePolicy=closed). This knowledge in turn also opens the door for locking down /dev further, e.g. explicitly setting DevicePolicy=strict (instead of closed), and making /dev private for the unit. Additional possible future (or downstream) lockdown that can be done is setting `PrivateDevices=true` (with `BindPaths=/dev/net/`), however, systemd 233 or later is required for this, and tailscaled currently need to work for systemd down to version 215. Closes https://github.com/tailscale/tailscale/issues/1063 Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com> 4 years ago			`ProtectClock=true`
tailscaled.service: Harden systemd unit somewhat (#1062) While not a full capability lockdown of the systemd unit, this still improves sandboxing and security of the running process a good deal. Signed-off-by: Frederik “Freso” S. Olesen <freso.dk@gmail.com> 4 years ago			`ProtectControlGroups=true`
			`ProtectHome=true`
			`ProtectKernelTunables=true`
			`ProtectSystem=strict`
			`ReadWritePaths=/etc/`
			`RestrictSUIDSGID=true`
			`SystemCallArchitectures=native`

tailscaled: add a systemd unit. Signed-off-by: David Anderson <dave@natulte.net> 5 years ago			`[Install]`
			`WantedBy=multi-user.target`