uhhm/varde
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

The socket unit owns /run/varde; the service names no runtime directory

Browse Source 
RuntimeDirectoryPreserve=yes (0.1.7) made systemd privatise the
directory under DynamicUser: /run/varde became a symlink into
/run/private, 0700, and no unprivileged client - the redoal relay, a
desktop app - could connect. Without RuntimeDirectory= on the service
the socket unit creates the directory (DirectoryMode=0755), nothing
removes it on a service stop, and nothing privatises it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Bendik Aagaard Lynghaug
2026-10-03 13:56:47 +02:00
co-authored by Claude Fable 5.1
parent a1776dbbed
commit 458c2a2266
2 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/varde.socket
Vendored
+3
View File
@@ -5,6 +5,9 @@ Description=varde API socket
[Socket]
ListenStream=/run/varde/varde.sock
SocketMode=0666
# The directory is this unit's, world-readable, so clients of any user
# reach the socket (see varde.service for why the service must not own it).
DirectoryMode=0755
[Install]
WantedBy=sockets.target