Bendik Aagaard LynghaugandClaude Fable 5.1
458c2a2266
RuntimeDirectoryPreserve=yes (0.1.7) made systemd privatise the directory under DynamicUser: /run/varde became a symlink into /run/private, 0700, and no unprivileged client - the redoal relay, a desktop app - could connect. Without RuntimeDirectory= on the service the socket unit creates the directory (DirectoryMode=0755), nothing removes it on a service stop, and nothing privatises it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
14 lines
347 B
SYSTEMD
14 lines
347 B
SYSTEMD
# Socket activation for the varde system daemon.
|
|
[Unit]
|
|
Description=varde API socket
|
|
|
|
[Socket]
|
|
ListenStream=/run/varde/varde.sock
|
|
SocketMode=0666
|
|
# The directory is this unit's, world-readable, so clients of any user
|
|
# reach the socket (see varde.service for why the service must not own it).
|
|
DirectoryMode=0755
|
|
|
|
[Install]
|
|
WantedBy=sockets.target
|