41 lines
2.0 KiB
Diff
41 lines
2.0 KiB
Diff
diff --git a/distro/systemd/openvpn-client@.service.in b/distro/systemd/openvpn-client@.service.in
|
|
index 159fb4dc..2277a7d9 100644
|
|
--- a/distro/systemd/openvpn-client@.service.in
|
|
+++ b/distro/systemd/openvpn-client@.service.in
|
|
@@ -11,6 +11,9 @@ Type=notify
|
|
PrivateTmp=true
|
|
WorkingDirectory=/etc/openvpn/client
|
|
ExecStart=@sbindir@/openvpn --suppress-timestamps --nobind --config %i.conf
|
|
+User=openvpn
|
|
+Group=network
|
|
+AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SETPCAP CAP_SYS_CHROOT CAP_DAC_OVERRIDE
|
|
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SETPCAP CAP_SYS_CHROOT CAP_DAC_OVERRIDE
|
|
LimitNPROC=10
|
|
DeviceAllow=/dev/null rw
|
|
diff --git a/distro/systemd/openvpn-server@.service.in b/distro/systemd/openvpn-server@.service.in
|
|
index 6e8e7d94..b2814e4b 100644
|
|
--- a/distro/systemd/openvpn-server@.service.in
|
|
+++ b/distro/systemd/openvpn-server@.service.in
|
|
@@ -11,6 +11,9 @@ Type=notify
|
|
PrivateTmp=true
|
|
WorkingDirectory=/etc/openvpn/server
|
|
ExecStart=@sbindir@/openvpn --status %t/openvpn-server/status-%i.log --status-version 2 --suppress-timestamps --config %i.conf
|
|
+User=openvpn
|
|
+Group=network
|
|
+AmbientCapabilities=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SETPCAP CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
|
|
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SETPCAP CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
|
|
LimitNPROC=10
|
|
DeviceAllow=/dev/null rw
|
|
diff --git a/src/openvpn/console_systemd.c b/src/openvpn/console_systemd.c
|
|
index 6e8e7d94..b2814e4b 100644
|
|
--- a/src/openvpn/console_systemd.c
|
|
+++ b/src/openvpn/console_systemd.c
|
|
@@ -71,6 +71,7 @@ get_console_input_systemd(const char *pr
|
|
#endif
|
|
argv_printf_cat(&argv, "--icon network-vpn");
|
|
argv_printf_cat(&argv, "--timeout=0");
|
|
+ argv_printf_cat(&argv, "--system");
|
|
argv_printf_cat(&argv, "%s", prompt);
|
|
|
|
if ((std_out = openvpn_popen(&argv, NULL)) < 0)
|