Compare commits
2 Commits
pr-systemd
...
dev-sane
Author | SHA1 | Date | |
---|---|---|---|
575341a22b | |||
a9f2f4602a |
@@ -15,8 +15,6 @@ If a change only affects particular applications, they are listed in parentheses
|
|||||||
- misc: Unify build system (!23 & !29, thanks @Jarrah & @vladimir.stoyakin)
|
- misc: Unify build system (!23 & !29, thanks @Jarrah & @vladimir.stoyakin)
|
||||||
- misc: Ensure stable file order during builds (!24, thanks @devrtz)
|
- misc: Ensure stable file order during builds (!24, thanks @devrtz)
|
||||||
- fix: Prevent logging internal LVGL errors to stdout
|
- fix: Prevent logging internal LVGL errors to stdout
|
||||||
- misc: Make scdoc a native dependency to enable cross-compilation (!30, thanks @uninsane)
|
|
||||||
- fix: Use usleep to release CPU when possible (!31, thanks @uninsane)
|
|
||||||
|
|
||||||
## 3.2.0 (2024-06-03)
|
## 3.2.0 (2024-06-03)
|
||||||
|
|
||||||
|
@@ -1,38 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Documentation=https://gitlab.postmarketos.org/postmarketOS/buffybox
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
ExecStart=@bindir@/buffyboard
|
|
||||||
Restart=on-failure
|
|
||||||
|
|
||||||
# Allow access to input devices, framebuffer, tty
|
|
||||||
DevicePolicy=closed
|
|
||||||
DeviceAllow=/dev/uinput rw
|
|
||||||
DeviceAllow=char-fb rw
|
|
||||||
DeviceAllow=char-input rw
|
|
||||||
DeviceAllow=char-tty rw
|
|
||||||
# udev requires some limited networking
|
|
||||||
RestrictAddressFamilies=AF_NETLINK
|
|
||||||
|
|
||||||
# Hardening
|
|
||||||
CapabilityBoundingSet=
|
|
||||||
NoNewPrivileges=true
|
|
||||||
RestrictSUIDSGID=true
|
|
||||||
PrivateMounts=true
|
|
||||||
PrivateTmp=true
|
|
||||||
PrivateUsers=true
|
|
||||||
ProtectClock=true
|
|
||||||
ProtectControlGroups=true
|
|
||||||
ProtectHome=true
|
|
||||||
ProtectHostname=true
|
|
||||||
ProtectKernelLogs=true
|
|
||||||
ProtectKernelModules=true
|
|
||||||
ProtectKernelTunables=true
|
|
||||||
ProtectSystem=strict
|
|
||||||
RemoveIPC=true
|
|
||||||
LockPersonality=true
|
|
||||||
MemoryDenyWriteExecute=true
|
|
||||||
SystemCallArchitectures=native
|
|
||||||
SystemCallFilter=@system-service
|
|
||||||
SystemCallFilter=~@privileged
|
|
||||||
SystemCallFilter=~@resources
|
|
@@ -24,20 +24,3 @@ executable('buffyboard',
|
|||||||
|
|
||||||
install_data('buffyboard.conf', install_dir: get_option('sysconfdir'))
|
install_data('buffyboard.conf', install_dir: get_option('sysconfdir'))
|
||||||
|
|
||||||
systemd = dependency('systemd', required: get_option('systemd-buffyboard-service'))
|
|
||||||
if systemd.found()
|
|
||||||
system_unit_dir = systemd.get_variable(
|
|
||||||
pkgconfig: 'systemd_system_unit_dir',
|
|
||||||
pkgconfig_define: ['prefix', get_option('prefix')],
|
|
||||||
)
|
|
||||||
|
|
||||||
configure_file(
|
|
||||||
input : 'buffyboard.service.in',
|
|
||||||
output : 'buffyboard.service',
|
|
||||||
install : true,
|
|
||||||
install_dir : system_unit_dir,
|
|
||||||
configuration : {
|
|
||||||
'bindir' : get_option('prefix') / get_option('bindir'),
|
|
||||||
},
|
|
||||||
)
|
|
||||||
endif
|
|
||||||
|
@@ -1,3 +1,2 @@
|
|||||||
option('with-drm', type: 'feature', value: 'auto', description: 'Enable DRM backend')
|
option('with-drm', type: 'feature', value: 'auto', description: 'Enable DRM backend')
|
||||||
option('man', type: 'boolean', value: true, description: 'Install manual pages')
|
option('man', type: 'boolean', value: true, description: 'Install manual pages')
|
||||||
option('systemd-buffyboard-service', type: 'feature', value: 'auto', description: 'Install systemd service file for buffyboard')
|
|
||||||
|
Reference in New Issue
Block a user