chiark / gitweb /
importd: run daemon at minimal capabilities
authorLennart Poettering <lennart@poettering.net>
Thu, 22 Jan 2015 17:55:08 +0000 (18:55 +0100)
committerLennart Poettering <lennart@poettering.net>
Thu, 22 Jan 2015 17:55:08 +0000 (18:55 +0100)
units/systemd-importd.service.in

index b9cb97e..26759ea 100644 (file)
@@ -12,8 +12,9 @@ Documentation=man:systemd-importd.service(8)
 [Service]
 ExecStart=@rootlibexecdir@/systemd-importd
 BusName=org.freedesktop.import1
 [Service]
 ExecStart=@rootlibexecdir@/systemd-importd
 BusName=org.freedesktop.import1
+CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_SYS_ADMIN CAP_SETPCAP
+NoNewPrivileges=yes
 WatchdogSec=1min
 PrivateTmp=yes
 WatchdogSec=1min
 PrivateTmp=yes
-PrivateDevices=yes
 ProtectSystem=full
 ProtectHome=yes
 ProtectSystem=full
 ProtectHome=yes