Don't set systemd ProtectHome=on by default.

diff --git a/NEWS.md b/NEWS.md
index 2b192b38b8329b2f9d1da5cbc4b156617acec537..e30d9903a36fb90bc61ee13f6c2265149016e7dd 100644 (file)
--- a/NEWS.md
+++ b/NEWS.md
@@ -39,6 +39,11 @@ Protocol: 31 (unchanged)
    also allows you to specify the value via the RSYNC_MAX_ALLOC environment
    variable.
 
+ - The default systemd config was changed to remove the `ProtectHome=on`
+   setting since rsync is often used to serve files in /home and this seemed a
+   bit too strict.  Feel free to use `systemctl edit rsync` to add that
+   restriction to your own setup, if you like.
+
  - The memory allocation functions now automatically check for a failure and
    die when out of memory.  This eliminated some caller-side check-and-die
    code and added some missing sanity-checking of allocations.
@@ -98,6 +103,11 @@ Protocol: 31 (unchanged)
 
 ### ENHANCEMENTS:
 
+ - The default systemd config was made a bit stricter by default.  For
+   instance, `ProtectHome=on` was added.  You can override this using the
+   standard `systemctl edit rsync` and add a line to turn that off under a
+   `[Service]` heading.
+
  - The use of `--backup-dir=STR` now implies `--backup`.
 
  - Added `--zl=NUM` as a short-hand for `--compress-level=NUM`.

diff --git a/packaging/systemd/rsync.service b/packaging/systemd/rsync.service
index fafe72b397e34b04df52abba2a926aa0d9abc5f4..5955db9e8e547e26707a8cf98ea526ba3dd3b391 100644 (file)
--- a/packaging/systemd/rsync.service
+++ b/packaging/systemd/rsync.service
@@ -23,7 +23,7 @@ RestartSec=1
 # See systemd.unit(5) and search for "drop-in" for full details.
 
 ProtectSystem=full
-ProtectHome=on
+#ProtectHome=on
 PrivateDevices=on
 NoNewPrivileges=on
 

diff --git a/packaging/systemd/rsync@.service b/packaging/systemd/rsync@.service
index e1f48da8416b9bea0f7858183a46326afd8ae8b6..3168cb6125e47f916c1eda6575eb16c11a04157b 100644 (file)
--- a/packaging/systemd/rsync@.service
+++ b/packaging/systemd/rsync@.service
@@ -23,6 +23,6 @@ StandardError=journal
 # See systemd.unit(5) and search for "drop-in" for full details.
 
 ProtectSystem=full
-ProtectHome=on
+#ProtectHome=on
 PrivateDevices=on
 NoNewPrivileges=on