picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

units: make use of PrivateTmp=yes and PrivateDevices=yes for all our long-running daemons

This commit is contained in:
Lennart Poettering 2014-03-19 16:45:28 +01:00
parent 7973ca1927
commit d99a705296
6 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
units/systemd-bus-driverd.service.in
View File

@ -13,3 +13,5 @@ ExecStart=@rootlibexecdir@/systemd-bus-driverd
BusName=org.freedesktop.DBus
WatchdogSec=1min
CapabilityBoundingSet=CAP_IPC_OWNER
PrivateTmp=yes
PrivateDevices=yes

2
units/systemd-bus-proxyd@.service.in
View File

@ -15,3 +15,5 @@ Description=Legacy D-Bus Protocol Compatibility Daemon
ExecStart=@rootlibexecdir@/systemd-bus-proxyd xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
NotifyAccess=main
CapabilityBoundingSet=CAP_IPC_OWNER
PrivateTmp=yes
PrivateDevices=yes

2
units/systemd-hostnamed.service.in
View File

@ -15,3 +15,5 @@ ExecStart=@rootlibexecdir@/systemd-hostnamed
BusName=org.freedesktop.hostname1
CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE
WatchdogSec=1min
PrivateTmp=yes
PrivateDevices=yes

2
units/systemd-localed.service.in
View File

@ -15,3 +15,5 @@ ExecStart=@rootlibexecdir@/systemd-localed
BusName=org.freedesktop.locale1
CapabilityBoundingSet=
WatchdogSec=1min
PrivateTmp=yes
PrivateDevices=yes

2
units/systemd-machined.service.in
View File

@ -17,3 +17,5 @@ ExecStart=@rootlibexecdir@/systemd-machined
BusName=org.freedesktop.machine1
CapabilityBoundingSet=CAP_KILL
WatchdogSec=1min
PrivateTmp=yes
PrivateDevices=yes

1
units/systemd-timedated.service.in
View File

@ -15,3 +15,4 @@ ExecStart=@rootlibexecdir@/systemd-timedated
BusName=org.freedesktop.timedate1
CapabilityBoundingSet=CAP_SYS_TIME
WatchdogSec=1min
PrivateTmp=yes