unit.conf: Fix Smack permission on api ws

[src/app-framework-main.git] / conf / unit / afm-unit.conf.in

diff --git a/conf/unit/afm-unit.conf.in b/conf/unit/afm-unit.conf.in
index bf9b32a..1824358 100644 (file)
--- a/conf/unit/afm-unit.conf.in
+++ b/conf/unit/afm-unit.conf.in
@@ -106,8 +106,7 @@ X-AFM--wgtdir={{:#metadata.install-dir}}
 X-AFM--workdir=/home/%i/app-data/{{:id}}
 %nl
 Requires=afm-user-session@%i.target
-Requires=afm-user-setup@%i.service
-After=afm-user-setup@%i.service
+After=user@%i.service
 # Adds check to smack
 ConditionSecurity=smack
 %nl
@@ -141,13 +140,13 @@ Slice=user-%i.slice
 WorkingDirectory=-/home/%i/app-data/{{:id}}
 ExecStartPre=/bin/mkdir -p /home/%i/app-data/{{:id}}
 Environment=AFM_APP_INSTALL_DIR={{:#metadata.install-dir}}
-Environment=PATH=/usr/sbin:/usr/bin:/sbin:/bin:{{:#metadata.install-dir}}
+Environment=PATH=/usr/sbin:/usr/bin:/sbin:/bin:{{:#metadata.install-dir}}/bin
+Environment=LD_LIBRARY_PATH={{:#metadata.install-dir}}/lib
 Environment=XDG_DATA_HOME=/home/%i/app-data/{{:id}}
 Environment=XDG_CONFIG_HOME=/home/%i/app-data/{{:id}}
 Environment=XDG_CACHE_HOME=/home/%i/app-data/{{:id}}
 Environment=XDG_RUNTIME_DIR=/run/user/%i
 Environment=DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/%i/bus
-Environment=LD_LIBRARY_PATH=$ORIGIN/lib
 SyslogIdentifier=afbd-{{idaver}}{{^#target=main}}@{{:#target}}{{/#target=main}}
 StandardInput=null
 StandardOutput=journal
@@ -212,11 +211,12 @@ WantedBy=afm-user-session@.target
 %systemd-unit socket afm-api-ws-{{name}}@
 [Unit]
 Description=Provides api {{name}} for user %i
-Requires=afm-user-setup@%i.service
-After=afm-user-setup@%i.service
+After=user@%i.service
 DefaultDependencies=no
 [Socket]
 SmackLabel=*
+SmackLabelIPIn=*
+SmackLabelIPOut=*
 ListenStream=/run/user/%i/apis/ws/{{name}}
 FileDescriptorName={{name}}
 Service=afm-{{#required-permission.urn:AGL:permission::public:hidden}}service{{/required-permission.urn:AGL:permission::public:hidden}}{{^required-permission.urn:AGL:permission::public:hidden}}appli{{/required-permission.urn:AGL:permission::public:hidden}}-{{:id}}--{{:ver}}--{{:#target}}@%i.service