32e6af3c36
Changes to qgs.service to make it more amenable to writing a strict SELinux policy. Also add patch to allow control over socket perms so QEMU can get access to the socket. Related: https://issues.redhat.com/browse/RHELPLAN-171792 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
25 lines
609 B
Desktop File
25 lines
609 B
Desktop File
[Unit]
|
|
Description=Intel(R) TD Quoting Generation Service
|
|
After=syslog.target network.target auditd.service mpa_registration.service
|
|
ConditionPathExists=/dev/sgx_enclave
|
|
Requires=mpa_registration.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=qgs
|
|
EnvironmentFile=-/etc/sysconfig/qgs
|
|
ExecStart=/usr/sbin/qgs --no-daemon -m=0666 $QGS_ARGS
|
|
ExecReload=/bin/kill -SIGHUP $MAINPID
|
|
Restart=on-failure
|
|
RestartSec=15s
|
|
|
|
RuntimeDirectory=tdx-qgs
|
|
WorkingDirectory=/var/lib/qgs
|
|
InaccessibleDirectories=/home
|
|
DevicePolicy=closed
|
|
DeviceAllow=/dev/sgx_enclave rw
|
|
DeviceAllow=/dev/sgx_provision rw
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|