units: add SecureBits

[elogind.git] / units / systemd-journal-upload.service.in

diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in
index 359ff10e259d4af338504d9f01966f125cb2b885..f8524ca2271996fe51a956b876b77bf5fe730870 100644 (file)
--- a/units/systemd-journal-upload.service.in
+++ b/units/systemd-journal-upload.service.in
@@ -12,10 +12,15 @@ After=network.target
 [Service]
 ExecStart=@rootlibexecdir@/systemd-journal-upload \
           --save-state
+SecureBits=noroot noroot-locked
 User=systemd-journal-upload
 PrivateTmp=yes
 PrivateDevices=yes
 WatchdogSec=20min
 
+# If there are many split up journal files we need a lot of fds to
+# access them all and combine
+LimitNOFILE=16384
+
 [Install]
 WantedBy=multi-user.target