Lennart Poettering
5bd7cc7a6b
This adds an operation equivalent to "systemd-sysupdate cleanup" after
an update completed (regardless if that update was entirely successful
or not). This ensures that any orphaned files are automatically cleaned
up, if they are not referenced by any transfer file's patterns anymore.
Follow-up for: d82e256bb9
35 lines
1.0 KiB
Desktop File
35 lines
1.0 KiB
Desktop File
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
# This file is part of systemd.
|
|
#
|
|
# systemd is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU Lesser General Public License as published by
|
|
# the Free Software Foundation; either version 2.1 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
[Unit]
|
|
Description=Automatic System Update
|
|
Documentation=man:systemd-sysupdate.service(8)
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
ConditionVirtualization=!container
|
|
|
|
[Service]
|
|
Type=simple
|
|
NotifyAccess=main
|
|
ExecStart=systemd-sysupdate update --cleanup=yes
|
|
CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_SYS_ADMIN CAP_SETPCAP CAP_DAC_OVERRIDE CAP_LINUX_IMMUTABLE
|
|
NoNewPrivileges=yes
|
|
MemoryDenyWriteExecute=yes
|
|
ProtectHostname=yes
|
|
RestrictRealtime=yes
|
|
RestrictNamespaces=net
|
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
|
SystemCallFilter=@system-service @mount
|
|
SystemCallErrorNumber=EPERM
|
|
SystemCallArchitectures=native
|
|
LockPersonality=yes
|
|
|
|
[Install]
|
|
Also=systemd-sysupdate.timer
|