diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index ffcb5f36ca..215696ecd1 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -18,25 +18,24 @@ Before=shutdown.target [Service] ExecStart=-@rootlibexecdir@/systemd-coredump -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes Nice=9 -NoNewPrivileges=yes OOMScoreAdjust=500 +RuntimeMaxSec=5min +PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes ProtectSystem=strict -RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=yes +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes -RuntimeMaxSec=5min -StateDirectory=systemd/coredump -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +StateDirectory=systemd/coredump diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index 9c925e80d9..da74b4fe8b 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -13,26 +13,25 @@ Documentation=man:systemd-hostnamed.service(8) man:hostname(5) man:machine-info( Documentation=https://www.freedesktop.org/wiki/Software/systemd/hostnamed [Service] -BusName=org.freedesktop.hostname1 -CapabilityBoundingSet=CAP_SYS_ADMIN ExecStart=@rootlibexecdir@/systemd-hostnamed -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes +BusName=org.freedesktop.hostname1 +WatchdogSec=3min +CapabilityBoundingSet=CAP_SYS_ADMIN +PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes ProtectSystem=strict -ReadWritePaths=/etc -RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=yes +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX SystemCallFilter=@system-service sethostname -WatchdogSec=3min +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +ReadWritePaths=/etc diff --git a/units/systemd-initctl.service.in b/units/systemd-initctl.service.in index c276283908..2b4b957dce 100644 --- a/units/systemd-initctl.service.in +++ b/units/systemd-initctl.service.in @@ -13,7 +13,6 @@ Documentation=man:systemd-initctl.service(8) DefaultDependencies=no [Service] -ExecStart=@rootlibexecdir@/systemd-initctl -NoNewPrivileges=yes NotifyAccess=all +ExecStart=@rootlibexecdir@/systemd-initctl SystemCallArchitectures=native diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in index ebc8bf9a25..a51d59d101 100644 --- a/units/systemd-journal-gatewayd.service.in +++ b/units/systemd-journal-gatewayd.service.in @@ -13,23 +13,22 @@ Documentation=man:systemd-journal-gatewayd(8) Requires=systemd-journal-gatewayd.socket [Service] -DynamicUser=yes ExecStart=@rootlibexecdir@/systemd-journal-gatewayd -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes +User=systemd-journal-gateway +SupplementaryGroups=systemd-journal +DynamicUser=yes PrivateDevices=yes PrivateNetwork=yes -ProtectControlGroups=yes ProtectHome=yes -ProtectKernelModules=yes +ProtectControlGroups=yes ProtectKernelTunables=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -RestrictNamespaces=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes -SupplementaryGroups=systemd-journal +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallArchitectures=native -User=systemd-journal-gateway +LockPersonality=yes # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index 29a99aaec1..fa8682cd28 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -14,24 +14,23 @@ Requires=systemd-journal-remote.socket [Service] ExecStart=@rootlibexecdir@/systemd-journal-remote --listen-https=-3 --output=/var/log/journal/remote/ -LockPersonality=yes -LogsDirectory=journal/remote -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateDevices=yes -PrivateNetwork=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -ProtectSystem=strict -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -RestrictNamespaces=yes -RestrictRealtime=yes -SystemCallArchitectures=native User=systemd-journal-remote WatchdogSec=3min +PrivateTmp=yes +PrivateDevices=yes +PrivateNetwork=yes +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +SystemCallArchitectures=native +LockPersonality=yes +LogsDirectory=journal/remote # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index 92cd4e5259..1ded990877 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -14,24 +14,23 @@ Wants=network-online.target After=network-online.target [Service] -DynamicUser=yes ExecStart=@rootlibexecdir@/systemd-journal-upload --save-state -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateDevices=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -RestrictNamespaces=yes -RestrictRealtime=yes -StateDirectory=systemd/journal-upload -SupplementaryGroups=systemd-journal -SystemCallArchitectures=native User=systemd-journal-upload +DynamicUser=yes +SupplementaryGroups=systemd-journal WatchdogSec=3min +PrivateDevices=yes +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +SystemCallArchitectures=native +LockPersonality=yes +StateDirectory=systemd/journal-upload # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 4684f095c0..41cac8cf65 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -16,25 +16,24 @@ After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-a Before=sysinit.target [Service] -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE +Type=notify +Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket ExecStart=@rootlibexecdir@/systemd-journald -FileDescriptorStoreMax=4224 -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes Restart=always RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_NETLINK -RestrictNamespaces=yes -RestrictRealtime=yes -Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket StandardOutput=null -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service -Type=notify WatchdogSec=3min +FileDescriptorStoreMax=4224 +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any # If there are many split up journal files we need a lot of fds to access them # all in parallel. diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index 01e0703d0e..a24e61a0cd 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -13,26 +13,25 @@ Documentation=man:systemd-localed.service(8) man:locale.conf(5) man:vconsole.con Documentation=https://www.freedesktop.org/wiki/Software/systemd/localed [Service] -BusName=org.freedesktop.locale1 -CapabilityBoundingSet= ExecStart=@rootlibexecdir@/systemd-localed -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes +BusName=org.freedesktop.locale1 +WatchdogSec=3min +CapabilityBoundingSet= +PrivateTmp=yes PrivateDevices=yes PrivateNetwork=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes ProtectSystem=strict -ReadWritePaths=/etc -RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=yes +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX SystemCallFilter=@system-service -WatchdogSec=3min +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +ReadWritePaths=/etc diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index 38a7f269ac..961263f607 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -20,23 +20,22 @@ Wants=dbus.socket After=dbus.socket [Service] -BusName=org.freedesktop.login1 -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG ExecStart=@rootlibexecdir@/systemd-logind -FileDescriptorStoreMax=512 -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes Restart=always RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_NETLINK -RestrictNamespaces=yes -RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service +BusName=org.freedesktop.login1 WatchdogSec=3min +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +FileDescriptorStoreMax=512 # Increase the default a bit in order to allow many simultaneous logins since # we keep one fd open per session. diff --git a/units/systemd-machined.service.in b/units/systemd-machined.service.in index 9f1476814d..1200a90a61 100644 --- a/units/systemd-machined.service.in +++ b/units/systemd-machined.service.in @@ -16,19 +16,18 @@ After=machine.slice RequiresMountsFor=/var/lib/machines [Service] -BusName=org.freedesktop.machine1 -CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD ExecStart=@rootlibexecdir@/systemd-machined -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service @mount +BusName=org.freedesktop.machine1 WatchdogSec=3min +CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 +SystemCallFilter=@system-service @mount +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any # Note that machined cannot be placed in a mount namespace, since it # needs access to the host's mount namespace in order to implement the diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index 472ef045de..65d3e2a660 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -19,29 +19,28 @@ Conflicts=shutdown.target Wants=network.target [Service] -AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW -CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW -ExecStart=!!@rootlibexecdir@/systemd-networkd -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectSystem=strict +Type=notify Restart=on-failure RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET -RestrictNamespaces=yes +ExecStart=!!@rootlibexecdir@/systemd-networkd +WatchdogSec=3min +User=systemd-network +CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW +AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes RuntimeDirectory=systemd/netif RuntimeDirectoryPreserve=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service -Type=notify -User=systemd-network -WatchdogSec=3min [Install] WantedBy=multi-user.target diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in index 3144b70063..ef5398cbf0 100644 --- a/units/systemd-resolved.service.in +++ b/units/systemd-resolved.service.in @@ -20,32 +20,31 @@ Conflicts=shutdown.target Wants=nss-lookup.target [Service] -AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE -CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE -ExecStart=!!@rootlibexecdir@/systemd-resolved -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateDevices=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -ProtectSystem=strict +Type=notify Restart=always RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -RestrictNamespaces=yes +ExecStart=!!@rootlibexecdir@/systemd-resolved +WatchdogSec=3min +User=systemd-resolve +CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE +AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE +PrivateTmp=yes +PrivateDevices=yes +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes RuntimeDirectory=systemd/resolve RuntimeDirectoryPreserve=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service -Type=notify -User=systemd-resolve -WatchdogSec=3min [Install] WantedBy=multi-user.target diff --git a/units/systemd-rfkill.service.in b/units/systemd-rfkill.service.in index 3abb958310..4b68f0b5a7 100644 --- a/units/systemd-rfkill.service.in +++ b/units/systemd-rfkill.service.in @@ -17,8 +17,7 @@ After=sys-devices-virtual-misc-rfkill.device systemd-remount-fs.service Before=shutdown.target [Service] -ExecStart=@rootlibexecdir@/systemd-rfkill -NoNewPrivileges=yes -StateDirectory=systemd/rfkill -TimeoutSec=30s Type=notify +ExecStart=@rootlibexecdir@/systemd-rfkill +TimeoutSec=30s +StateDirectory=systemd/rfkill diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index 6d53024195..906bb4326c 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -13,24 +13,23 @@ Documentation=man:systemd-timedated.service(8) man:localtime(5) Documentation=https://www.freedesktop.org/wiki/Software/systemd/timedated [Service] -BusName=org.freedesktop.timedate1 -CapabilityBoundingSet=CAP_SYS_TIME ExecStart=@rootlibexecdir@/systemd-timedated -IPAddressDeny=any -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -ProtectSystem=strict -ReadWritePaths=/etc -RestrictAddressFamilies=AF_UNIX -RestrictNamespaces=yes -RestrictRealtime=yes -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service @clock +BusName=org.freedesktop.timedate1 WatchdogSec=3min +CapabilityBoundingSet=CAP_SYS_TIME +PrivateTmp=yes +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX +SystemCallFilter=@system-service @clock +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +IPAddressDeny=any +ReadWritePaths=/etc diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 03ade45d08..12f918dd11 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -19,32 +19,31 @@ Conflicts=shutdown.target Wants=time-sync.target [Service] -AmbientCapabilities=CAP_SYS_TIME -CapabilityBoundingSet=CAP_SYS_TIME -ExecStart=!!@rootlibexecdir@/systemd-timesyncd -LockPersonality=yes -MemoryDenyWriteExecute=yes -NoNewPrivileges=yes -PrivateDevices=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectKernelTunables=yes -ProtectSystem=strict +Type=notify Restart=always RestartSec=0 -RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -RestrictNamespaces=yes -RestrictRealtime=yes -RuntimeDirectory=systemd/timesync -StateDirectory=systemd/timesync -SystemCallArchitectures=native -SystemCallErrorNumber=EPERM -SystemCallFilter=@system-service @clock -Type=notify -User=systemd-timesync +ExecStart=!!@rootlibexecdir@/systemd-timesyncd WatchdogSec=3min +User=systemd-timesync +CapabilityBoundingSet=CAP_SYS_TIME +AmbientCapabilities=CAP_SYS_TIME +PrivateTmp=yes +PrivateDevices=yes +ProtectSystem=strict +ProtectHome=yes +ProtectControlGroups=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +MemoryDenyWriteExecute=yes +RestrictRealtime=yes +RestrictNamespaces=yes +RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RuntimeDirectory=systemd/timesync +SystemCallFilter=@system-service @clock +SystemCallErrorNumber=EPERM +SystemCallArchitectures=native +LockPersonality=yes +StateDirectory=systemd/timesync [Install] WantedBy=sysinit.target