tor/contrib/dist/tor.service.in

[Unit]
Description = Anonymizing overlay network for TCP
After = syslog.target network.target nss-lookup.target

[Service]
Type = notify
NotifyAccess = all
ExecStartPre = @BINDIR@/tor -f @CONFDIR@/torrc --verify-config
ExecStart = @BINDIR@/tor -f @CONFDIR@/torrc 
ExecReload = /bin/kill -HUP ${MAINPID}
KillSignal = SIGINT
TimeoutSec = 30
Restart = on-failure
LimitNOFILE = 32768

# Hardening
PrivateTmp = yes
DeviceAllow = /dev/null rw
DeviceAllow = /dev/urandom r
InaccessibleDirectories = /home
ReadOnlyDirectories = /
ReadWriteDirectories = @LOCALSTATEDIR@/lib/tor
ReadWriteDirectories = @LOCALSTATEDIR@/log/tor
ReadWriteDirectories = @LOCALSTATEDIR@/run/tor
NoNewPrivileges = yes

[Install]
WantedBy = multi-user.target
Add contrib/tor.service for use with systemd 2014-04-21 15:47:44 +02:00			`[Unit]`
			`Description = Anonymizing overlay network for TCP`
			`After = syslog.target network.target nss-lookup.target`

			`[Service]`
send PID of the main daemon to supervisor If running under systemd, notify the supervisor about current PID of Tor daemon. This makes systemd unit simpler and more robust: it will do the right thing regardless of RunAsDaemon settings. 2015-01-09 22:17:50 +01:00			`Type = notify`
			`NotifyAccess = all`
Verify configuration file via ExecStartPre in the systemd unit file (#12730). 2014-07-29 14:13:01 +02:00			`ExecStartPre = @BINDIR@/tor -f @CONFDIR@/torrc --verify-config`
send PID of the main daemon to supervisor If running under systemd, notify the supervisor about current PID of Tor daemon. This makes systemd unit simpler and more robust: it will do the right thing regardless of RunAsDaemon settings. 2015-01-09 22:17:50 +01:00			`ExecStart = @BINDIR@/tor -f @CONFDIR@/torrc`
Add contrib/tor.service for use with systemd 2014-04-21 15:47:44 +02:00			`ExecReload = /bin/kill -HUP ${MAINPID}`
			`KillSignal = SIGINT`
			`TimeoutSec = 30`
			`Restart = on-failure`
			`LimitNOFILE = 32768`

			`# Hardening`
			`PrivateTmp = yes`
			`DeviceAllow = /dev/null rw`
			`DeviceAllow = /dev/urandom r`
			`InaccessibleDirectories = /home`
systemd unit file: only allow tor to write to /var/lib/tor and /var/log/tor (#12751). The rest of the filesystem is accessible for reading only. Still, quoting systemd.exec(5): Note that restricting access with these options does not extend to submounts of a directory that are created later on. 2014-08-27 05:05:12 +02:00			`ReadOnlyDirectories = /`
			`ReadWriteDirectories = @LOCALSTATEDIR@/lib/tor`
			`ReadWriteDirectories = @LOCALSTATEDIR@/log/tor`
systemd unit file: set up /var/run/tor as writable for the Tor service. For some strange reason, this was not needed with systemd v208. But it's needed with systemd v215 on current Debian sid, and entirely makes sense. 2014-09-19 18:04:59 +02:00			`ReadWriteDirectories = @LOCALSTATEDIR@/run/tor`
systemd unit file: ensures that the process and all its children can never gain new privileges (#12939). 2014-08-27 05:18:26 +02:00			`NoNewPrivileges = yes`
Add contrib/tor.service for use with systemd 2014-04-21 15:47:44 +02:00
			`[Install]`
			`WantedBy = multi-user.target`