diff options
| author | Lennart Poettering <lennart@poettering.net> | 2019-03-20 19:52:20 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2019-04-02 16:56:48 +0200 |
| commit | 62aa29247c3d74bcec0607c347f2be23cd90675d (patch) | |
| tree | 5bbb870abd0f9911b3d7191c4227f980f0aa9fbe /units/systemd-udevd.service.in | |
| parent | man: document the new RestrictSUIDSGID= setting (diff) | |
| download | systemd-62aa29247c3d74bcec0607c347f2be23cd90675d.tar.xz systemd-62aa29247c3d74bcec0607c347f2be23cd90675d.zip | |
units: turn on RestrictSUIDSGID= in most of our long-running daemons
Diffstat (limited to 'units/systemd-udevd.service.in')
| -rw-r--r-- | units/systemd-udevd.service.in | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/units/systemd-udevd.service.in b/units/systemd-udevd.service.in index fb98ca4d43..e8a76cc018 100644 --- a/units/systemd-udevd.service.in +++ b/units/systemd-udevd.service.in @@ -28,8 +28,9 @@ TasksMax=infinity PrivateMounts=yes ProtectHostname=yes MemoryDenyWriteExecute=yes -RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 +RestrictRealtime=yes +RestrictSUIDSGID=yes SystemCallFilter=@system-service @module @raw-io SystemCallErrorNumber=EPERM SystemCallArchitectures=native |