units: add SecureBits

[elogind.git] / units / systemd-journald.service.in

diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in
index a3540c65d2e70085ecd4fa242f93ab176c1a58a9..b48e4ad1aaf4f3175a077ec99ce90ab41c8ec6f7 100644 (file)
--- a/units/systemd-journald.service.in
+++ b/units/systemd-journald.service.in
@@ -22,6 +22,7 @@ RestartSec=0
 NotifyAccess=all
 StandardOutput=null
 CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE
+SecureBits=noroot noroot-locked
 WatchdogSec=1min
 FileDescriptorStoreMax=1024