48 lines
1.7 KiB
Desktop File
48 lines
1.7 KiB
Desktop File
[Unit]
|
|
Description=Enodia Sentinel Go migration validation sidecar
|
|
After=network.target
|
|
Documentation=https://github.com/Enodia/enodia-sentinel
|
|
|
|
[Service]
|
|
Type=notify
|
|
NotifyAccess=main
|
|
TimeoutStartSec=120
|
|
# Keep this path independent from enodia-sentinel.service. The sidecar emits
|
|
# enodia.event.v1 JSONL to the journal and owns only its separate state tree.
|
|
ExecStart=/usr/bin/env enodia-sentinel-go --config /etc/enodia-sentinel.toml --state-dir /var/lib/enodia-sentinel-go --event-log /var/lib/enodia-sentinel-go/events.jsonl --event-log-max-bytes 67108864 --snapshot-dir /var/lib/enodia-sentinel-go --ebpf-exec --ebpf-syscall
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
StateDirectory=enodia-sentinel-go
|
|
StateDirectoryMode=0750
|
|
UMask=0077
|
|
|
|
# The embedded CO-RE programs do not need a compiler or writable executable
|
|
# memory. The broad CAP_SYS_ADMIN fallback keeps tracepoint attachment working
|
|
# on kernels predating the narrower CAP_BPF/CAP_PERFMON privilege split.
|
|
ProtectSystem=strict
|
|
ProtectHome=read-only
|
|
InaccessiblePaths=-/var/log/enodia-sentinel
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateMounts=yes
|
|
ProtectClock=yes
|
|
ProtectHostname=yes
|
|
ProtectKernelLogs=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
RestrictSUIDSGID=yes
|
|
RestrictRealtime=yes
|
|
MemoryDenyWriteExecute=yes
|
|
LockPersonality=yes
|
|
RestrictNamespaces=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_NETLINK
|
|
SystemCallArchitectures=native
|
|
CapabilityBoundingSet=CAP_SYS_PTRACE CAP_DAC_READ_SEARCH CAP_BPF CAP_PERFMON CAP_SYS_ADMIN CAP_SYS_RESOURCE
|
|
AmbientCapabilities=CAP_SYS_PTRACE CAP_DAC_READ_SEARCH CAP_BPF CAP_PERFMON CAP_SYS_ADMIN CAP_SYS_RESOURCE
|
|
LimitMEMLOCK=infinity
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|