2ec71e439f
If logging disappears issues are hard to debug, hence let's give journald a slight edge over other services when the OOM killer hits. Here are the special adjustments we now make: systemd-coredump@.service.in OOMScoreAdjust=500 systemd-journald.service.in OOMScoreAdjust=-250 systemd-udevd.service.in OOMScoreAdjust=-1000 (i.e. the coredump processing is made more likely to be killed on OOM, and udevd and journald are less likely to be killed)
40 lines
1.2 KiB
SYSTEMD
40 lines
1.2 KiB
SYSTEMD
# SPDX-License-Identifier: LGPL-2.1+
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=udev Kernel Device Manager
|
|
Documentation=man:systemd-udevd.service(8) man:udev(7)
|
|
DefaultDependencies=no
|
|
After=systemd-sysusers.service systemd-hwdb-update.service
|
|
Before=sysinit.target
|
|
ConditionPathIsReadWrite=/sys
|
|
|
|
[Service]
|
|
Type=notify
|
|
# Note that udev also adjusts the OOM score internally and will reset the value internally for its workers
|
|
OOMScoreAdjust=-1000
|
|
Sockets=systemd-udevd-control.socket systemd-udevd-kernel.socket
|
|
Restart=always
|
|
RestartSec=0
|
|
ExecStart=@rootlibexecdir@/systemd-udevd
|
|
KillMode=mixed
|
|
WatchdogSec=3min
|
|
TasksMax=infinity
|
|
PrivateMounts=yes
|
|
ProtectHostname=yes
|
|
MemoryDenyWriteExecute=yes
|
|
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
|
|
RestrictRealtime=yes
|
|
RestrictSUIDSGID=yes
|
|
SystemCallFilter=@system-service @module @raw-io
|
|
SystemCallErrorNumber=EPERM
|
|
SystemCallArchitectures=native
|
|
LockPersonality=yes
|
|
IPAddressDeny=any
|