From 48d3e88c18258d423c3953372ec4a2e638ab0422 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 6 Oct 2017 16:05:20 +0900 Subject: [PATCH] timesyncd: enable DynamicUser= --- src/timesync/timesyncd.c | 2 +- units/systemd-timesyncd.service.in | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/src/timesync/timesyncd.c b/src/timesync/timesyncd.c index d895aa8cc1..c026ef79a4 100644 --- a/src/timesync/timesyncd.c +++ b/src/timesync/timesyncd.c @@ -69,7 +69,7 @@ static int load_clock_timestamp(uid_t uid, gid_t gid) { } } else { - r = mkdir_safe_label("/var/lib/systemd/timesync", 0755, uid, gid, false); + r = mkdir_safe_label("/var/lib/systemd/timesync", 0755, uid, gid, true); if (r < 0) return log_error_errno(r, "Failed to create state directory: %m"); diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 8d3f46cf5e..ed4bc8e552 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -23,11 +23,10 @@ RestartSec=0 ExecStart=!!@rootlibexecdir@/systemd-timesyncd WatchdogSec=3min User=systemd-timesync +DynamicUser=yes CapabilityBoundingSet=CAP_SYS_TIME AmbientCapabilities=CAP_SYS_TIME -PrivateTmp=yes PrivateDevices=yes -ProtectSystem=strict ProtectHome=yes ProtectControlGroups=yes ProtectKernelTunables=yes