A few more systemd tweaks.

diff --git a/NEWS.md b/NEWS.md
index e30d9903a36fb90bc61ee13f6c2265149016e7dd..14284729ebd524818d4878ad60bde1ff3ad31607 100644 (file)
--- a/NEWS.md
+++ b/NEWS.md
@@ -40,9 +40,10 @@ Protocol: 31 (unchanged)
    variable.
 
  - The default systemd config was changed to remove the `ProtectHome=on`
-   setting since rsync is often used to serve files in /home and this seemed a
-   bit too strict.  Feel free to use `systemctl edit rsync` to add that
-   restriction to your own setup, if you like.
+   setting since rsync is often used to serve files in /home and /root and this
+   seemed a bit too strict.  Feel free to use `systemctl edit rsync` to add
+   that restriction (or maybe `ProtectHome=read-only`), if you like.  See the
+   3.2.0 NEWS for the other restrictions that were added compared to 3.1.3.
 
  - The memory allocation functions now automatically check for a failure and
    die when out of memory.  This eliminated some caller-side check-and-die
@@ -103,11 +104,6 @@ Protocol: 31 (unchanged)
 
 ### ENHANCEMENTS:
 
- - The default systemd config was made a bit stricter by default.  For
-   instance, `ProtectHome=on` was added.  You can override this using the
-   standard `systemctl edit rsync` and add a line to turn that off under a
-   `[Service]` heading.
-
  - The use of `--backup-dir=STR` now implies `--backup`.
 
  - Added `--zl=NUM` as a short-hand for `--compress-level=NUM`.
@@ -201,6 +197,13 @@ Protocol: 31 (unchanged)
 
 ### ENHANCEMENTS:
 
+ - The default systemd config was made stricter by default.  For instance,
+   `ProtectHome=on` (which hides content in /root and /home/USER dirs),
+   `ProtectSystem=full` (which makes /usr, /boot, & /etc dirs read-only), and
+   `PrivateDevices=on` (which hides devices).  You can override any of these
+   using the standard `systemctl edit rsync` and add one or more directives
+   under a `[Service]` heading (and restart the rsync service).
+
  - Various checksum enhancements, including the optional use of openssl's MD4 &
    MD5 checksum algorithms, some x86-64 optimizations for the rolling checksum,
    some x86-64 optimizations for the (non-openssl) MD5 checksum, the addition

diff --git a/packaging/systemd/rsync.service b/packaging/systemd/rsync.service
index 5955db9e8e547e26707a8cf98ea526ba3dd3b391..8a0b5820a006b84ce2ae81821f148fda3422c7e0 100644 (file)
--- a/packaging/systemd/rsync.service
+++ b/packaging/systemd/rsync.service
@@ -16,14 +16,14 @@ RestartSec=1
 #   This is generally used for public file distribution, [...]
 #
 # So let's assume some extra security is more than welcome here. We do full
-# system protection (which makes it read-only) and hide users' homes and
+# system protection (which makes /usr, /boot, & /etc read-only) and hide
 # devices. To override these defaults, it's best to do so in the drop-in
 # directory, often done via `systemctl edit rsync.service`. The file needs
 # just the bare minimum of the right [heading] and override values.
 # See systemd.unit(5) and search for "drop-in" for full details.
 
 ProtectSystem=full
-#ProtectHome=on
+#ProtectHome=on|off|read-only
 PrivateDevices=on
 NoNewPrivileges=on
 

diff --git a/packaging/systemd/rsync@.service b/packaging/systemd/rsync@.service
index 3168cb6125e47f916c1eda6575eb16c11a04157b..63ba0c7c4667f32eee886dc9693524a9bf6924cf 100644 (file)
--- a/packaging/systemd/rsync@.service
+++ b/packaging/systemd/rsync@.service
@@ -16,13 +16,13 @@ StandardError=journal
 #   This is generally used for public file distribution, [...]
 #
 # So let's assume some extra security is more than welcome here. We do full
-# system protection (which makes it read-only) and hide users' homes and
+# system protection (which makes /usr, /boot, & /etc read-only) and hide
 # devices. To override these defaults, it's best to do so in the drop-in
 # directory, often done via `systemctl edit rsync@.service`. The file needs
 # just the bare minimum of the right [heading] and override values.
 # See systemd.unit(5) and search for "drop-in" for full details.
 
 ProtectSystem=full
-#ProtectHome=on
+#ProtectHome=on|off|read-only
 PrivateDevices=on
 NoNewPrivileges=on