mirror of
https://github.com/ClickHouse/ClickHouse.git
synced 2024-11-23 08:02:02 +00:00
1fe8076b94
CapabilityBoundingSet that contained in systemd unit before is about
allowing to set some capabilities, not about granting them.
To grant them you need to use AmbientCapabilities.
And if you do not use 'clickhouse install' then:
- IO priorities was unavailable (since they requires CAP_SYS_NICE)
- For taskstats the procfs was used instead of netlink
Not a big deal, but still.
Here how it had been tested:
$ systemd-run -p CapabilityBoundingSet=CAP_NET_ADMIN --shell
root:/etc (master)# capsh --print
Current: cap_net_admin=ep
Bounding set =cap_net_admin
Ambient set =
$ systemd-run -p User=azat -p CapabilityBoundingSet=CAP_NET_ADMIN --shell
azat:/etc$ capsh --print
Current: =
Bounding set =cap_net_admin
Ambient set =
$ systemd-run -p User=azat -p AmbientCapabilities=CAP_NET_ADMIN -p CapabilityBoundingSet=CAP_NET_ADMIN --shell
azat:/etc$ capsh --print
Current: cap_net_admin=eip
Bounding set =cap_net_admin
Ambient set =cap_net_admin
Note, if you are running it under root (without changing user) you don't
need to specify AmbientCapabilities additionally, because root has all
capabilities by default and they had been inherited.
Signed-off-by: Azat Khuzhin <a.khuzhin@semrush.com>
37 lines
1.4 KiB
Desktop File
37 lines
1.4 KiB
Desktop File
[Unit]
|
|
Description=ClickHouse Server (analytic DBMS for big data)
|
|
Requires=network-online.target
|
|
# NOTE: that After/Wants=time-sync.target is not enough, you need to ensure
|
|
# that the time was adjusted already, if you use systemd-timesyncd you are
|
|
# safe, but if you use ntp or some other daemon, you should configure it
|
|
# additionaly.
|
|
After=time-sync.target network-online.target
|
|
Wants=time-sync.target
|
|
|
|
[Service]
|
|
Type=notify
|
|
|
|
# NOTE: we leave clickhouse watchdog process enabled to be able to see OOM/SIGKILL traces in clickhouse-server.log files.
|
|
# If you wish to disable the watchdog and rely on systemd logs just add "Environment=CLICKHOUSE_WATCHDOG_ENABLE=0" line.
|
|
User=clickhouse
|
|
Group=clickhouse
|
|
Restart=always
|
|
RestartSec=30
|
|
# Since ClickHouse is systemd aware default 1m30sec may not be enough
|
|
TimeoutStartSec=0
|
|
# %p is resolved to the systemd unit name
|
|
RuntimeDirectory=%p
|
|
ExecStart=/usr/bin/clickhouse-server --config=/etc/clickhouse-server/config.xml --pid-file=%t/%p/%p.pid
|
|
# Minus means that this file is optional.
|
|
EnvironmentFile=-/etc/default/%p
|
|
# Bring back /etc/default/clickhouse for backward compatibility
|
|
EnvironmentFile=-/etc/default/clickhouse
|
|
LimitCORE=infinity
|
|
LimitNOFILE=500000
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_IPC_LOCK CAP_SYS_NICE CAP_NET_BIND_SERVICE
|
|
AmbientCapabilities=CAP_NET_ADMIN CAP_IPC_LOCK CAP_SYS_NICE CAP_NET_BIND_SERVICE
|
|
|
|
[Install]
|
|
# ClickHouse should not start from the rescue shell (rescue.target).
|
|
WantedBy=multi-user.target
|