units: add SecureBits

[elogind.git] / units / systemd-journal-gatewayd.service.in

diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in
index 5bd8e4b34174edf3a025e7d48acd7e178ed82fca..f15a37f9d1750b6addb17fd4ed12feffcbfdcb33 100644 (file)
--- a/units/systemd-journal-gatewayd.service.in
+++ b/units/systemd-journal-gatewayd.service.in
@@ -11,6 +11,7 @@ Requires=systemd-journal-gatewayd.socket
 
 [Service]
 ExecStart=@rootlibexecdir@/systemd-journal-gatewayd
+SecureBits=noroot noroot-locked
 User=systemd-journal-gateway
 Group=systemd-journal-gateway
 SupplementaryGroups=systemd-journal
@@ -20,5 +21,9 @@ PrivateNetwork=yes
 ProtectSystem=full
 ProtectHome=yes
 
+# If there are many split upjournal files we need a lot of fds to
+# access them all and combine
+LimitNOFILE=16384
+
 [Install]
 Also=systemd-journal-gatewayd.socket