units: add SecureBits

[elogind.git] / units / systemd-journal-upload.service.in

diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in
index e79f96204394e90aec19aafea3ac513231595650..f8524ca2271996fe51a956b876b77bf5fe730870 100644 (file)
--- a/units/systemd-journal-upload.service.in
+++ b/units/systemd-journal-upload.service.in
@@ -7,15 +7,20 @@
 
 [Unit]
 Description=Journal Remote Upload Service
+After=network.target
 
 [Service]
 ExecStart=@rootlibexecdir@/systemd-journal-upload \
           --save-state
+SecureBits=noroot noroot-locked
 User=systemd-journal-upload
 PrivateTmp=yes
 PrivateDevices=yes
 WatchdogSec=20min
 
+# If there are many split up journal files we need a lot of fds to
+# access them all and combine
+LimitNOFILE=16384
+
 [Install]
 WantedBy=multi-user.target
-After=network.target