diff options
| author | CoprDistGit <infra@openeuler.org> | 2024-08-16 22:05:20 +0000 |
|---|---|---|
| committer | CoprDistGit <infra@openeuler.org> | 2024-08-16 22:05:20 +0000 |
| commit | 71ef4b2e33e682ead93afc90409e5e55e0f83fab (patch) | |
| tree | a0e3b8c2f40011eeb98851744e8689513d4d1e2e /freerouter-p4mnl.service | |
| parent | 7c925059f0d92d7f6f2400c8102e5ccec1f1bffb (diff) | |
automatic import of freerouter
Diffstat (limited to 'freerouter-p4mnl.service')
| -rw-r--r-- | freerouter-p4mnl.service | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/freerouter-p4mnl.service b/freerouter-p4mnl.service new file mode 100644 index 0000000..82c3c4e --- /dev/null +++ b/freerouter-p4mnl.service @@ -0,0 +1,37 @@ +[Unit] +Description=p4mnl specific process of freerouter +Requires=freerouter.service freerouter-native@cpu_port.service network.target +After=freerouter.service freerouter-native@cpu_port.service network.target + +[Service] +Type=simple +ExecStart=/usr/bin/p4mnl_user.bin 127.0.0.1 9080 2 eth1 eth2 veth250 +ExecStopPost=-/usr/sbin/ip link set dev eth1 xdpgeneric off +ExecStopPost=-/usr/sbin/ip link set dev eth2 xdpgeneric off +ExecStopPost=-/usr/sbin/ip link set dev veth250 xdpgeneric off +Restart=always +RestartSec=5 +WorkingDirectory=/var/lib/freerouter +User=freerouter +Group=freerouter +CapabilityBoundingSet=CAP_NET_RAW CAP_NET_ADMIN CAP_IPC_LOCK CAP_SYS_ADMIN +AmbientCapabilities=CAP_NET_RAW CAP_NET_ADMIN CAP_IPC_LOCK CAP_SYS_ADMIN +NoNewPrivileges=true +ProtectSystem=strict +ProtectHome=true +ReadWritePaths=/var/lib/freerouter /etc/freerouter +PrivateTmp=true +# PrivateDevices is not possible because some types need access to a physical device. +PrivateDevices=false +PrivateNetwork=false +# Private Users clears all capabilities. +PrivateUsers=false +ProtectKernelTunables=true +ProtectKernelModules=true +ProtectControlGroups=true +RestrictNamespaces=true +LockPersonality=true +RemoveIPC=true + +[Install] +WantedBy=multi-user.target |