diff options
| author | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2018-11-14 17:03:33 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-11-14 17:03:33 +0100 |
| commit | 6b638d3b0beb071412164c1d9fe42814996f9385 (patch) | |
| tree | 75b4df2cea3ab33949ff646bd75dafaa8e2ab579 | |
| parent | 8755568681ed42ab8b2acd0763bd4bb4788d82d1 (diff) | |
| download | systemd-revert-10744-logind-lock-down.tar.gz | |
Revert "units: lock down logind with fs namespacing options"revert-10744-logind-lock-down
| -rw-r--r-- | units/systemd-logind.service.in | 10 |
1 files changed, 1 insertions, 9 deletions
diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index 6886fa9bfe..38a7f269ac 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -21,26 +21,18 @@ After=dbus.socket [Service] BusName=org.freedesktop.login1 -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG ExecStart=@rootlibexecdir@/systemd-logind FileDescriptorStoreMax=512 IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes NoNewPrivileges=yes -PrivateTmp=yes -ProtectControlGroups=yes -ProtectHome=yes -ProtectKernelModules=yes -ProtectSystem=strict -ReadWritePaths=/etc Restart=always RestartSec=0 RestrictAddressFamilies=AF_UNIX AF_NETLINK RestrictNamespaces=yes RestrictRealtime=yes -RuntimeDirectory=systemd/sessions systemd/seats systemd/users -RuntimeDirectoryPreserve=yes SystemCallArchitectures=native SystemCallErrorNumber=EPERM SystemCallFilter=@system-service |