bughz/glider
1
0
Fork 0
mirror of https://github.com/nadoo/glider.git synced 2025-11-04 07:42:38 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

systemd: add CapabilityBoundingSet settings in service file so that glider can listen on port below 1024 with none-root user

Browse Source
This commit is contained in:
nadoo 2017-08-24 11:58:32 +08:00
parent 4e4e778f1d
commit 1a941cd095
3 changed files with 17 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
README.md
View File

@ -30,15 +30,15 @@ General:
- Rule proxy based on destionation: [Config Examples](examples) - Rule proxy based on destionation: [Config Examples](examples)
TODO: TODO:
- Specify different remote dns server in rule file (DONE) - [x] Specify different remote dns server in rule file
- Improve DNS forwarder to resolve domain name and add ip to proxy rules (DONE) - [x] Improve DNS forwarder to resolve domain name and add ip to proxy rules
- IPSet management - [ ] IPSet management
- Improve DNS forwarder to resolve domain name and add ip to ipset - [ ] Improve DNS forwarder to resolve domain name and add ip to ipset
- UDP Tunnel & UDP Relay - [ ] UDP Tunnel & UDP Relay
- TUN/TAP device support - [ ] TUN/TAP device support
- Code refactoring: support proxy registering so it can be pluggable - [ ] Code refactoring: support proxy registering so it can be pluggable
- Conditional compilation so we can abandon needless proxy type and get a smaller binary size - [ ] Conditional compilation so we can abandon needless proxy type and get a smaller binary size
- SSH tunnel support - [ ] SSH tunnel support
## Install ## Install
Binary: Binary:

1
conf.go
View File

@ -66,6 +66,7 @@ func confInit() {
conf.rules = append(conf.rules, rule) conf.rules = append(conf.rules, rule)
} }
// TODO: allow to use relative dir to the config file
ruleFolderFiles, _ := listDir(conf.RulesDir, ".rule") ruleFolderFiles, _ := listDir(conf.RulesDir, ".rule")
for _, ruleFile := range ruleFolderFiles { for _, ruleFile := range ruleFolderFiles {
rule, err := NewRuleConfFromFile(ruleFile) rule, err := NewRuleConfFromFile(ruleFile)

7
systemd/glider@.service
View File

@ -6,7 +6,14 @@ After=network.target
Type=simple Type=simple
User=nobody User=nobody
Restart=always Restart=always
# NOTE: change to your glider path
ExecStart=/usr/bin/glider -config /etc/glider/%i.conf ExecStart=/usr/bin/glider -config /etc/glider/%i.conf
# work with systemd v229 or later, so glider can listen on port below 1024 with none-root user
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target