RepoMirrors
/
ceph
mirror of https://github.com/ceph/ceph
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
ceph/systemd/ceph-immutable-object-cache...

30 lines
779 B
SYSTEMD
Raw Normal View History

tools: adding ceph level immutable obj cache daemon The daemon is built for future integration with both RBD and RGW cache. The key components are: - domain socket based simple IPC - simple LRU policy based promotion/demotion for the cache - simple file based caching store for RADOS objs with sync IO interface - systemd service/target files for the daemon Signed-off-by: Dehao Shang <dehao.shang@intel.com> Signed-off-by: Yuan Zhou <yuan.zhou@intel.com>
2018-12-13 21:36:36 +00:00
[Unit]
Description=Ceph immutable object cache daemon
After=network-online.target local-fs.target
Wants=network-online.target local-fs.target
PartOf=ceph-immutable-object-cache.target
[Service]
Environment=CLUSTER=ceph
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
EnvironmentFile=-@SYSTEMD_ENV_FILE@
tools: adding ceph level immutable obj cache daemon The daemon is built for future integration with both RBD and RGW cache. The key components are: - domain socket based simple IPC - simple LRU policy based promotion/demotion for the cache - simple file based caching store for RADOS objs with sync IO interface - systemd service/target files for the daemon Signed-off-by: Dehao Shang <dehao.shang@intel.com> Signed-off-by: Yuan Zhou <yuan.zhou@intel.com>
2018-12-13 21:36:36 +00:00
ExecReload=/bin/kill -HUP $MAINPID
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
ExecStart=/usr/bin/ceph-immutable-object-cache -f --cluster ${CLUSTER} --id %i --setuser ceph --setgroup ceph
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
tools: adding ceph level immutable obj cache daemon The daemon is built for future integration with both RBD and RGW cache. The key components are: - domain socket based simple IPC - simple LRU policy based promotion/demotion for the cache - simple file based caching store for RADOS objs with sync IO interface - systemd service/target files for the daemon Signed-off-by: Dehao Shang <dehao.shang@intel.com> Signed-off-by: Yuan Zhou <yuan.zhou@intel.com>
2018-12-13 21:36:36 +00:00
PrivateDevices=yes
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
PrivateTmp=true
ProtectControlGroups=true
tools: adding ceph level immutable obj cache daemon The daemon is built for future integration with both RBD and RGW cache. The key components are: - domain socket based simple IPC - simple LRU policy based promotion/demotion for the cache - simple file based caching store for RADOS objs with sync IO interface - systemd service/target files for the daemon Signed-off-by: Dehao Shang <dehao.shang@intel.com> Signed-off-by: Yuan Zhou <yuan.zhou@intel.com>
2018-12-13 21:36:36 +00:00
ProtectHome=true
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
tools: adding ceph level immutable obj cache daemon The daemon is built for future integration with both RBD and RGW cache. The key components are: - domain socket based simple IPC - simple LRU policy based promotion/demotion for the cache - simple file based caching store for RADOS objs with sync IO interface - systemd service/target files for the daemon Signed-off-by: Dehao Shang <dehao.shang@intel.com> Signed-off-by: Yuan Zhou <yuan.zhou@intel.com>
2018-12-13 21:36:36 +00:00
ProtectSystem=full
Restart=on-failure
systemd: lock down more privileges Including: ProtectClock=true ProtectHostname=true ProtectKernelLogs=true RestrictSUIDSGID=true Also, alphabetize [service] settings. Finally, add some protections for systemd/ceph-immutable-object-cache@.service.in present in our other service files but not this one. Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 21:41:47 +00:00
RestrictSUIDSGID=true
tools: adding ceph level immutable obj cache daemon The daemon is built for future integration with both RBD and RGW cache. The key components are: - domain socket based simple IPC - simple LRU policy based promotion/demotion for the cache - simple file based caching store for RADOS objs with sync IO interface - systemd service/target files for the daemon Signed-off-by: Dehao Shang <dehao.shang@intel.com> Signed-off-by: Yuan Zhou <yuan.zhou@intel.com>
2018-12-13 21:36:36 +00:00
StartLimitBurst=3
[Install]
WantedBy=ceph-immutable-object-cache.target