portable: drop explicit PrivateTmp=yes from profiles

It is already implied by DynamicUser=yes if not set, but dropping it allows users to instead define TemporaryFileSystem=/tmp/ /var/tmp/ in their portable services, which has fewer side effects.
systemd · May 8, 2024 · 20c1844 · 20c1844
1 parent 4954b4a
commit 20c1844
Show file tree

Hide file tree

Showing 3 changed files with 0 additions and 3 deletions.
diff --git a/src/portable/profile/default/service.conf b/src/portable/profile/default/service.conf
@@ -12,7 +12,6 @@ CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER
 	CAP_FSETID CAP_IPC_LOCK CAP_IPC_OWNER CAP_KILL CAP_MKNOD CAP_NET_ADMIN \
 	CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_SETGID CAP_SETPCAP \
 	CAP_SETUID CAP_SYS_ADMIN CAP_SYS_CHROOT CAP_SYS_NICE CAP_SYS_RESOURCE
-PrivateTmp=yes
 PrivateDevices=yes
 PrivateUsers=yes
 ProtectSystem=strict

diff --git a/src/portable/profile/nonetwork/service.conf b/src/portable/profile/nonetwork/service.conf
@@ -10,7 +10,6 @@ RemoveIPC=yes
 CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER \
 	CAP_FSETID CAP_IPC_LOCK CAP_IPC_OWNER CAP_KILL CAP_MKNOD CAP_SETGID CAP_SETPCAP \
 	CAP_SETUID CAP_SYS_ADMIN CAP_SYS_CHROOT CAP_SYS_NICE CAP_SYS_RESOURCE
-PrivateTmp=yes
 PrivateDevices=yes
 PrivateUsers=yes
 ProtectSystem=strict

diff --git a/src/portable/profile/strict/service.conf b/src/portable/profile/strict/service.conf
@@ -7,7 +7,6 @@ BindReadOnlyPaths=/etc/machine-id
 DynamicUser=yes
 RemoveIPC=yes
 CapabilityBoundingSet=
-PrivateTmp=yes
 PrivateDevices=yes
 PrivateUsers=yes
 ProtectSystem=strict