Experimental Physics and
Industrial Control System

Michael Davidsaver via Tech-talk <tech-talk at aps.anl.gov> · Sun, 23 May 2021 07:57:07 -0700

The caRepeater.service currently included in Base is in need of improvement.
eg. to not run as root.

https://github.com/epics-base/epics-base/blob/b777233efb06fa4e988c4f0738b0270dd3d095a3/modules/ca/src/client/caRepeater.service%40#L1

Has anyone gone through the exercise of producing a unit file which restricts caRepeater?

Maybe with PrivateUsers=true to avoid manually allocating a username,
and/or some restrictions on filesystem access?

Ideally a unit file in Base would work back to systemd 219 (circa rhel/centos7)
without modification.  Although this doesn't seem like a hard requirement to me.
It seems reasonable to have some comments describing any edits needed with older systemd.

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System