Add systemd unit files

Change-Id: I17322ef7eda1f3bf0bc53b887508fadf039250cc

systemd/ndn-traffic-client.service.in

@@ -0,0 +1,42 @@
+[Unit]
+Description=NDN Traffic Generator Client
+BindsTo=nfd.service
+After=nfd.service
+
+[Service]
+Environment=HOME=%S/ndn/ndn-traffic-client
+EnvironmentFile=-@SYSCONFDIR@/default/ndn-traffic-client
+ExecStart=@BINDIR@/ndn-traffic-client @SYSCONFDIR@/ndn/ndn-traffic-client.conf $FLAGS
+Restart=on-failure
+RestartPreventExitStatus=2
+User=ndn-traffic-generator
+
+CapabilityBoundingSet=
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+PrivateTmp=yes
+PrivateUsers=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+# systemd older than v232 doesn't support a value of "strict" for ProtectSystem,
+# so it will ignore that line and use ProtectSystem=full; with newer systemd,
+# the latter assignment is recognized and takes precedence, resulting in an
+# effective setting of ProtectSystem=strict
+ProtectSystem=full
+ProtectSystem=strict
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+StateDirectory=ndn/ndn-traffic-client
+SystemCallArchitectures=native
+SystemCallErrorNumber=EPERM
+SystemCallFilter=~@aio @chown @clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap
+
+[Install]
+WantedBy=multi-user.target
+WantedBy=nfd.service

systemd/ndn-traffic-server.service.in

@@ -0,0 +1,42 @@
+[Unit]
+Description=NDN Traffic Generator Server
+BindsTo=nfd.service
+After=nfd.service
+
+[Service]
+Environment=HOME=%S/ndn/ndn-traffic-server
+EnvironmentFile=-@SYSCONFDIR@/default/ndn-traffic-server
+ExecStart=@BINDIR@/ndn-traffic-server @SYSCONFDIR@/ndn/ndn-traffic-server.conf $FLAGS
+Restart=on-failure
+RestartPreventExitStatus=2
+User=ndn-traffic-generator
+
+CapabilityBoundingSet=
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+PrivateTmp=yes
+PrivateUsers=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+# systemd older than v232 doesn't support a value of "strict" for ProtectSystem,
+# so it will ignore that line and use ProtectSystem=full; with newer systemd,
+# the latter assignment is recognized and takes precedence, resulting in an
+# effective setting of ProtectSystem=strict
+ProtectSystem=full
+ProtectSystem=strict
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+StateDirectory=ndn/ndn-traffic-server
+SystemCallArchitectures=native
+SystemCallErrorNumber=EPERM
+SystemCallFilter=~@aio @chown @clock @cpu-emulation @debug @keyring @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap
+
+[Install]
+WantedBy=multi-user.target
+WantedBy=nfd.service

wscript

@@ -33,3 +33,10 @@ def build(bld):
 
     bld.install_files('${SYSCONFDIR}/ndn', ['ndn-traffic-client.conf.sample',
                                             'ndn-traffic-server.conf.sample'])
+
+    if Utils.unversioned_sys_platform() == 'linux':
+        systemd_units = bld.path.ant_glob('systemd/*.in')
+        bld(features='subst',
+            name='systemd-units',
+            source=systemd_units,
+            target=[u.change_ext('') for u in systemd_units])