From 7d6efb777ee5be2c8928ee5e946823672fe13ceb Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 13 Mar 2024 10:14:48 +0900 Subject: [PATCH 1/2] unit: sort option --- units/systemd-networkd.service.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index 200b126faa..099e7211e6 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -26,6 +26,7 @@ CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_N DeviceAllow=char-* rw ExecStart=!!{{LIBEXECDIR}}/systemd-networkd FileDescriptorStoreMax=512 +ImportCredential=network.wireguard.* LockPersonality=yes MemoryDenyWriteExecute=yes NoNewPrivileges=yes @@ -50,7 +51,6 @@ SystemCallErrorNumber=EPERM SystemCallFilter=@system-service Type=notify-reload User=systemd-network -ImportCredential=network.wireguard.* {{SERVICE_WATCHDOG}} [Install] From 6f9148bab97170393db2005222b66d82e0477aaa Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 13 Mar 2024 10:15:23 +0900 Subject: [PATCH 2/2] unit: do not trigger automount for /boot and/or /efi ProtectSystem=full remounts /boot and/or /efi read-only, but that may trigger automount for the paths and delay the service being started. === systemd[1]: boot.automount: Got automount request for /boot, triggered by 720 ((networkd)) === The service does not need to access the paths, so let's hide them. Follow-up for f90eb086270f0aea8efcbff5a5e4c338d178cfd4. Fixes #31742. --- units/systemd-networkd.service.in | 1 + 1 file changed, 1 insertion(+) diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index 099e7211e6..bfbc0b193e 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -27,6 +27,7 @@ DeviceAllow=char-* rw ExecStart=!!{{LIBEXECDIR}}/systemd-networkd FileDescriptorStoreMax=512 ImportCredential=network.wireguard.* +InaccessiblePaths=-/boot -/efi LockPersonality=yes MemoryDenyWriteExecute=yes NoNewPrivileges=yes