Commit Graph

5 Commits

Author SHA1 Message Date
Kefu Chai 5659920c7c systemd: do not pass --cluster option
we do not encourage user to run multiple cluster using different
cluster name since 8fe460e756, and
the recommended way is to use cephadm. see also
https://docs.ceph.com/en/latest/rados/configuration/common/#naming-clusters-deprecated,
so let's stop passing `--cluster` in systemd service units. there
are more places where we are still feeding this optoin to command line
tools or services. we should do the cleanup piecemeal to reduce the
potential risk.

FWIW, if not specified, the cluster name is "ceph" by default.

Signed-off-by: Kefu Chai <tchaikov@gmail.com>
2024-02-13 15:07:01 +08:00
Wong Hoi Sing Edison 85bc551b17
systemd: remove `ProtectClock=true` for `ceph-osd@.service`
Ceph 16.2.0 Pacific by https://github.com/ceph/ceph/commit/9a84d5a introduce following new systemd restriction:

    ProtectClock=true
    ProtectHostname=true
    ProtectKernelLogs=true
    RestrictSUIDSGID=true

BTW, `ceph-osd@.service` failed with `ProtectClock=true` unexpectly, also see:

  - <https://lists.ceph.io/hyperkitty/list/ceph-users@ceph.io/thread/TNBGGNN6STGDKARAQTQCIPTU4KLIVJQV/>
  - <https://serverfault.com/questions/1059317/bluestore-var-lib-ceph-osd-ceph-2-block-read-bdev-label-failed-to-open-var-l>

This PR intruduce:

  - Remove `ProtectClock=true` for our systemd service templates

Fixes: https://tracker.ceph.com/issues/50347
Signed-off-by: Wong Hoi Sing Edison <hswong3i@pantarei-design.com>
2021-04-14 22:19:49 +08:00
Patrick Donnelly 9a84d5a09b
systemd: lock down more privileges
Including:

        ProtectClock=true
        ProtectHostname=true
        ProtectKernelLogs=true
        RestrictSUIDSGID=true

Also, alphabetize [service] settings.

Finally, add some protections for
systemd/ceph-immutable-object-cache@.service.in present in our other
service files but not this one.

Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2020-05-09 14:53:05 -07:00
Patrick Donnelly 517670926a
systemd: lock down privileges more
Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
2019-02-07 08:45:00 -08:00
Kefu Chai 4865831b91 cmake,deb: set EnvironmentFile using cmake
this change also fix the EnvironmentFile specified in rbdmap.service.
without this change EnvironmentFile in rbdmap.service is always
/etc/sysconfig/ceph even on debian derived distros. after this change,
this variable is /etc/default/ceph in rbdmap.service shipped by the deb
packages.

Signed-off-by: Kefu Chai <kchai@redhat.com>
2018-02-28 00:23:48 +08:00