KOKINIO - MANAGER
Edit File: gssproxy.service
[Unit] Description=GSSAPI Proxy Daemon # GSSPROXY will not be started until syslog is After=syslog.target network.target Before=rpc-gssd.service [Service] StateDirectory=gssproxy/clients gssproxy/rcache StateDirectoryMode=0700 Environment=KRB5RCACHEDIR=/var/lib/gssproxy/rcache ExecStart=/usr/sbin/gssproxy -i # This can be changed to notify-reload and ExecReload= can be removed once # systemd 253 is common enough Type=notify ExecReload=/bin/kill -HUP $MAINPID ProtectSystem=full ProtectClock=true ProtectKernelLogs=true ProtectControlGroups=true RestrictRealtime=true # NoNewPrivileges: when true breaks the ability to open a socket # under /var/lib/gssproxy so no NoNewPrivileges # PrivateTmp: can't be used as it hides ccaches stored in /tmp # ProtectHome: blocks access to /home which may hold ccaches # ProtectHostname: blocks propagation of hostname on change # but in some cases, when using a keytab, we may want to see hostname # changes as the server will want to respond only for the system name # ProtectKernelTunables: blocks ability to write to proc. # on startup gssproxy needs to write in proc to let nfsd know it can # use the "new" gssproxy method instead of the old rpc stuff. [Install] WantedBy=multi-user.target