transmission/daemon/transmission-daemon.service

[Unit]
Description=Transmission BitTorrent Daemon
Wants=network-online.target
After=network-online.target

[Service]
User=transmission
Type=notify
ExecStart=/usr/bin/transmission-daemon -f --log-error
ExecReload=/bin/kill -s HUP $MAINPID
NoNewPrivileges=true
MemoryDenyWriteExecute=true
ProtectSystem=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target
(trunk daemon) add a systemd service file for transmission-daemon. Suggestions / improvements welcomed at https://trac.transmissionbt.com/ticket/4503 2013-06-09 18:18:09 +00:00			`[Unit]`
			`Description=Transmission BitTorrent Daemon`
fix(daemon): wait for network-online.target (#2721) network.target does not guarantee interfaces are fully configured, which can result in bound addresses not being available when the daemon starts. This leads to errors on start-up and potentially broken connectivity. network-online.target does provide these guarantees, but needs a slightly different dependency configuration with Wants= on top of After= (cf. systemd.special(7)). Closes #2720. 2022-03-01 03:25:07 +00:00			`Wants=network-online.target`
			`After=network-online.target`
(trunk daemon) add a systemd service file for transmission-daemon. Suggestions / improvements welcomed at https://trac.transmissionbt.com/ticket/4503 2013-06-09 18:18:09 +00:00
			`[Service]`
			`User=transmission`
in transmission-daemon.service, remove unnecessary comments and change Type from simple to notify since transmission-daemon uses sd_notify() 2013-06-09 19:54:58 +00:00			`Type=notify`
don't hardcode the config dir, as discussed in ticket #4503 comments 17, 19 2013-06-09 22:52:33 +00:00			`ExecStart=/usr/bin/transmission-daemon -f --log-error`
(trunk, daemon) #5503: add an ExecReload rule to the systemd service file. 2014-01-21 02:19:48 +00:00			`ExecReload=/bin/kill -s HUP $MAINPID`
daemon: harden transmission-daemon.service Systemd 227 introduced the option to make a service disallow elevating privileges. 2018-12-28 21:23:33 +00:00			`NoNewPrivileges=true`
daemon: deny memory wx in transmission-daemon.service (#2573) Attempts to create memory mappings that are writable and executable at the same time, or to change existing memory mappings to become executable, or mapping shared memory segments as executable are prohibited. There's no reason transmission should be doing that. If it does, it's because of malicious code exploiting a vulnerability. See: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#MemoryDenyWriteExecute= 2022-02-05 04:08:51 +00:00			`MemoryDenyWriteExecute=true`
Add ProtectSystem and PrivateTmp to systemd service (#1452) ProtectSystem mounts /boot, /efi and /usr as read only, basically disallowing the daemon from ever writing there. PrivateTmp sets up a file system namespace for /tmp and /var/tmp/ basically hiding it from other processes. Co-authored-by: Charles Kerr <charles@charleskerr.com> 2022-02-13 20:06:55 +00:00			`ProtectSystem=true`
			`PrivateTmp=true`
(trunk daemon) add a systemd service file for transmission-daemon. Suggestions / improvements welcomed at https://trac.transmissionbt.com/ticket/4503 2013-06-09 18:18:09 +00:00
			`[Install]`
			`WantedBy=multi-user.target`