Merge branch 'master' into comparisons

6 files changed, 76 insertions, 19 deletions

diff --git a/debian/bin/restart.sh b/debian/bin/restart.sh
index 34fce0670..4847b918b 100755
--- a/debian/bin/restart.sh
+++ b/debian/bin/restart.sh
@@ -11,23 +11,43 @@
 #
 # This script is used by the Debian/Ubuntu/Fedora/CentOS packages.
 
-get_service_command() {
-    for command in systemctl service; do
-        if which $command &>/dev/null; then
-            echo $command && return
+# This is the Right Way(tm) to check if we are booted with
+# systemd, according to sd_booted(3)
+if [ -d /run/systemd/system ]; then
+    cmd=systemctl
+else
+    # Everything else is really hard to figure out, so we just use
+    # service(8) if it's available - that works with most init
+    # systems/distributions I know of, including FreeBSD
+    if type service >/dev/null 2>&1; then
+        cmd=service
+    else
+        # If even service(8) isn't available, we just try /etc/init.d
+        # and hope for the best
+        if [ -d /etc/init.d ]; then
+            cmd=sysv
+        else
+            echo "Unable to detect a way to restart Jellyfin; bailing out" 1>&2
+            echo "Please report this bug to https://github.com/jellyfin/jellyfin/issues" 1>&2
+            exit 1
         fi
-    done
-    echo "sysv"
-}
+    fi
+fi
+
+if type sudo >/dev/null 2>&1; then
+    sudo_command=sudo
+else
+    sudo_command=
+fi
 
-cmd="$( get_service_command )"
 echo "Detected service control platform '$cmd'; using it to restart Jellyfin..."
 case $cmd in
     'systemctl')
-        echo "sleep 0.5; /usr/bin/sudo $( which systemctl ) start jellyfin" | at now 
+        # Without systemd-run here, `jellyfin.service`'s shutdown terminates this process too
+        $sudo_command systemd-run systemctl restart jellyfin
         ;;
     'service')
-        echo "sleep 0.5; /usr/bin/sudo $( which service ) jellyfin start" | at now 
+        echo "sleep 0.5; $sudo_command service jellyfin start" | at now
         ;;
     'sysv')
         echo "sleep 0.5; /usr/bin/sudo /etc/init.d/jellyfin start" | at now 
diff --git a/debian/conf/jellyfin b/debian/conf/jellyfin
index 9ebaf2bd8..ab8d5d1d4 100644
--- a/debian/conf/jellyfin
+++ b/debian/conf/jellyfin
@@ -33,6 +33,9 @@ JELLYFIN_FFMPEG_OPT="--ffmpeg=/usr/lib/jellyfin-ffmpeg/ffmpeg"
 # [OPTIONAL] run Jellyfin without the web app
 #JELLYFIN_NOWEBAPP_OPT="--nowebclient"
 
+# Space to add additional command line options to jellyfin (for help see ~$ jellyfin --help)
+JELLYFIN_ADDITIONAL_OPTS=""
+
 # [OPTIONAL] run Jellyfin with ASP.NET Server Garbage Collection (uses more RAM and less CPU than Workstation GC)
 # 0 = Workstation
 # 1 = Server
@@ -45,4 +48,4 @@ JELLYFIN_FFMPEG_OPT="--ffmpeg=/usr/lib/jellyfin-ffmpeg/ffmpeg"
 # Application username
 JELLYFIN_USER="jellyfin"
 # Full application command
-JELLYFIN_ARGS="$JELLYFIN_WEB_OPT $JELLYFIN_RESTART_OPT $JELLYFIN_FFMPEG_OPT $JELLYFIN_SERVICE_OPT $JELLYFIN_NOWEBAPP_OPT"
+JELLYFIN_ARGS="$JELLYFIN_WEB_OPT $JELLYFIN_RESTART_OPT $JELLYFIN_FFMPEG_OPT $JELLYFIN_SERVICE_OPT $JELLYFIN_NOWEBAPP_OPT $JELLFIN_ADDITIONAL_OPTS"
diff --git a/debian/conf/jellyfin-sudoers b/debian/conf/jellyfin-sudoers
index b481ba4ad..f84e7454f 100644
--- a/debian/conf/jellyfin-sudoers
+++ b/debian/conf/jellyfin-sudoers
@@ -2,9 +2,9 @@
 Cmnd_Alias RESTARTSERVER_SYSV = /sbin/service jellyfin restart, /usr/sbin/service jellyfin restart
 Cmnd_Alias STARTSERVER_SYSV = /sbin/service jellyfin start, /usr/sbin/service jellyfin start
 Cmnd_Alias STOPSERVER_SYSV = /sbin/service jellyfin stop, /usr/sbin/service jellyfin stop
-Cmnd_Alias RESTARTSERVER_SYSTEMD = /usr/bin/systemctl restart jellyfin, /bin/systemctl restart jellyfin
-Cmnd_Alias STARTSERVER_SYSTEMD = /usr/bin/systemctl start jellyfin, /bin/systemctl start jellyfin
-Cmnd_Alias STOPSERVER_SYSTEMD = /usr/bin/systemctl stop jellyfin, /bin/systemctl stop jellyfin
+Cmnd_Alias RESTARTSERVER_SYSTEMD = /usr/bin/systemd-run systemctl restart jellyfin
+Cmnd_Alias STARTSERVER_SYSTEMD = /usr/bin/systemd-run systemctl start jellyfin
+Cmnd_Alias STOPSERVER_SYSTEMD = /usr/bin/systemd-run systemctl stop jellyfin
 Cmnd_Alias RESTARTSERVER_INITD = /etc/init.d/jellyfin restart
 Cmnd_Alias STARTSERVER_INITD = /etc/init.d/jellyfin start
 Cmnd_Alias STOPSERVER_INITD = /etc/init.d/jellyfin stop
diff --git a/debian/control b/debian/control
index 9675d36ca..da9aa94d4 100644
--- a/debian/control
+++ b/debian/control
@@ -3,7 +3,7 @@ Section: misc
 Priority: optional
 Maintainer: Jellyfin Team <team@jellyfin.org>
 Build-Depends:  debhelper (>= 9),
-                dotnet-sdk-5.0,
+                dotnet-sdk-6.0,
                 libc6-dev,
                 libcurl4-openssl-dev,
                 libfontconfig1-dev,
@@ -23,6 +23,6 @@ Depends: at,
          libfontconfig1,
          libfreetype6,
          libssl1.1
-Recommends: jellyfin-web
+Recommends: jellyfin-web, sudo
 Description: Jellyfin is the Free Software Media System.
  This package provides the Jellyfin server backend and API.
diff --git a/debian/jellyfin.service b/debian/jellyfin.service
index f1a8f4652..b86f40473 100644
--- a/debian/jellyfin.service
+++ b/debian/jellyfin.service
@@ -1,14 +1,48 @@
 [Unit]
 Description = Jellyfin Media Server
-After = network.target
+After = network-online.target
 
 [Service]
 Type = simple
 EnvironmentFile = /etc/default/jellyfin
 User = jellyfin
-ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT}
+ExecStart = /usr/bin/jellyfin ${JELLYFIN_WEB_OPT} ${JELLYFIN_RESTART_OPT} ${JELLYFIN_FFMPEG_OPT} ${JELLYFIN_SERVICE_OPT} ${JELLYFIN_NOWEBAPP_OPT} ${JELLYFIN_ADDITIONAL_OPTS}
 Restart = on-failure
 TimeoutSec = 15
 
+NoNewPrivileges=true
+SystemCallArchitectures=native
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+ProtectControlGroups=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+LockPersonality=true
+PrivateTmp=true
+PrivateDevices=false
+PrivateUsers=true
+RemoveIPC=true
+SystemCallFilter=~@clock
+SystemCallFilter=~@aio
+SystemCallFilter=~@chown
+SystemCallFilter=~@cpu-emulation
+SystemCallFilter=~@debug
+SystemCallFilter=~@keyring
+SystemCallFilter=~@memlock
+SystemCallFilter=~@module
+SystemCallFilter=~@mount
+SystemCallFilter=~@obsolete
+SystemCallFilter=~@privileged
+SystemCallFilter=~@raw-io
+SystemCallFilter=~@reboot
+SystemCallFilter=~@setuid
+SystemCallFilter=~@swap
+SystemCallErrorNumber=EPERM
+
+
 [Install]
 WantedBy = multi-user.target
diff --git a/debian/rules b/debian/rules
index 96541f41b..64e2b48ea 100755
--- a/debian/rules
+++ b/debian/rules
@@ -39,7 +39,7 @@ override_dh_auto_test:
 override_dh_clistrip:
 
 override_dh_auto_build:
-	dotnet publish --configuration $(CONFIG) --output='$(CURDIR)/usr/lib/jellyfin/bin' --self-contained --runtime $(DOTNETRUNTIME) \
+	dotnet publish -maxcpucount:1 --configuration $(CONFIG) --output='$(CURDIR)/usr/lib/jellyfin/bin' --self-contained --runtime $(DOTNETRUNTIME) \
 		"-p:DebugSymbols=false;DebugType=none" Jellyfin.Server
 
 override_dh_auto_clean: