# SPDX-License-Identifier: GPL-2.0-or-later
#
# Copyright (c) 2026 Oracle.  All Rights Reserved.
# Author: Darrick J. Wong <djwong@kernel.org>

[Unit]
Description=Start Self Healing of XFS Metadata

[Service]
Type=exec
Environment=SERVICE_MODE=1
ExecCondition=/usr/libexec/xfsprogs/xfs_healer_start --supported
ExecStart=/usr/libexec/xfsprogs/xfs_healer_start

# This service starts more services, so we want it to try to restart any time
# the program exits or crashes.
Restart=on-failure

# Create the service underneath the healer background service slice so that we
# can control resource usage.
Slice=system-xfs_healer.slice

# No realtime CPU scheduling
RestrictRealtime=true

# Must run with full privileges in a shared mount namespace so that we can
# see new mounts and tell systemd to start the per-mount healer service.
DynamicUser=false
ProtectSystem=false
ProtectHome=no
PrivateTmp=true
PrivateDevices=true

# Don't let healer complain about paths in /etc/projects that have been hidden
# by our sandboxing.  healer doesn't care about project ids anyway.
InaccessiblePaths=-/etc/projects

# No network access except to the systemd control socket
PrivateNetwork=true
ProtectHostname=true
RestrictAddressFamilies=AF_UNIX
IPAddressDeny=any

# Don't let the program mess with the kernel configuration at all
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
ProtectProc=invisible
RestrictNamespaces=true

# Hide everything in /proc, even /proc/mounts
ProcSubset=pid

# Only allow the default personality Linux
LockPersonality=true

# No writable memory pages
MemoryDenyWriteExecute=true

# Don't let our mounts leak out to the host
PrivateMounts=true

# Restrict system calls to the native arch and fanotify
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged
SystemCallFilter=~@resources
SystemCallFilter=~@mount
SystemCallFilter=fanotify_init fanotify_mark

# xfs_healer_start needs these privileges to open the rootdir and monitor
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE
AmbientCapabilities=CAP_SYS_ADMIN CAP_DAC_OVERRIDE
NoNewPrivileges=true

# xfs_healer_start doesn't create files
UMask=7777

# No access to hardware /dev files except for block devices
ProtectClock=true
DevicePolicy=closed

[Install]
WantedBy=multi-user.target