diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 019bc3bae5..849baec974 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -1053,7 +1053,7 @@ CapabilityBoundingSet=~CAP_B CAP_C Takes a boolean argument. If true, explicit module loading will be denied. This allows to turn off module load and unload operations on modular kernels. It is recommended to turn this on for most services - that do not need special file systems or extra kernel modules to work. Default to off. Enabling this option + that do not need special file systems or extra kernel modules to work. Defaults to off. Enabling this option removes CAP_SYS_MODULE from the capability bounding set for the unit, and installs a system call filter to block module system calls, also /usr/lib/modules is made inaccessible. For this setting the same restrictions regarding mount propagation and privileges apply as for