a18449b5bd
ProtectHostname= turns off hostname change propagation from host to service. This means for services that care about the hostname and need to be able to notice changes to it it's not suitable (though it is useful for most other cases still). Let's turn it off hence for journald (which logs the current hostname) for networkd (which optionally sends the current hostname to dhcp servers) and resolved (which announces the current hostname via llmnr/mdns).
53 lines
1.7 KiB
SYSTEMD
53 lines
1.7 KiB
SYSTEMD
# SPDX-License-Identifier: LGPL-2.1+
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=Network Name Resolution
|
|
Documentation=man:systemd-resolved.service(8)
|
|
Documentation=https://www.freedesktop.org/wiki/Software/systemd/resolved
|
|
Documentation=https://www.freedesktop.org/wiki/Software/systemd/writing-network-configuration-managers
|
|
Documentation=https://www.freedesktop.org/wiki/Software/systemd/writing-resolver-clients
|
|
DefaultDependencies=no
|
|
After=systemd-sysusers.service systemd-networkd.service
|
|
Before=network.target nss-lookup.target shutdown.target
|
|
Conflicts=shutdown.target
|
|
Wants=nss-lookup.target
|
|
|
|
[Service]
|
|
AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
|
|
CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
|
|
ExecStart=!!@rootlibexecdir@/systemd-resolved
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
NoNewPrivileges=yes
|
|
PrivateDevices=yes
|
|
PrivateTmp=yes
|
|
ProtectControlGroups=yes
|
|
ProtectHome=yes
|
|
ProtectKernelModules=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectSystem=strict
|
|
Restart=always
|
|
RestartSec=0
|
|
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
|
|
RestrictNamespaces=yes
|
|
RestrictRealtime=yes
|
|
RuntimeDirectory=systemd/resolve
|
|
RuntimeDirectoryPreserve=yes
|
|
SystemCallArchitectures=native
|
|
SystemCallErrorNumber=EPERM
|
|
SystemCallFilter=@system-service
|
|
Type=notify
|
|
User=systemd-resolve
|
|
WatchdogSec=3min
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
Alias=dbus-org.freedesktop.resolve1.service
|