machined: run machined at minimal capabilities

diff --git a/units/systemd-machined.service.in b/units/systemd-machined.service.in
index 87a81b9c854df2cd2d5dee179ec9219621f1efc3..26bfe0353790f9b3e4a8d61d26bb78a637cd491b 100644 (file)
--- a/units/systemd-machined.service.in
+++ b/units/systemd-machined.service.in
@@ -17,3 +17,4 @@ ExecStart=@rootlibexecdir@/systemd-machined
 Restart=always
 RestartSec=0
 BusName=org.freedesktop.machine1
+CapabilityBoundingSet=CAP_KILL