diff options
Diffstat (limited to 'units/systemd-journal-remote.service.in')
| -rw-r--r-- | units/systemd-journal-remote.service.in | 27 |
1 files changed, 16 insertions, 11 deletions
diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index a94265f215..29a99aaec1 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -14,23 +14,28 @@ Requires=systemd-journal-remote.socket [Service] ExecStart=@rootlibexecdir@/systemd-journal-remote --listen-https=-3 --output=/var/log/journal/remote/ -User=systemd-journal-remote -WatchdogSec=3min -PrivateTmp=yes +LockPersonality=yes +LogsDirectory=journal/remote +MemoryDenyWriteExecute=yes +NoNewPrivileges=yes PrivateDevices=yes PrivateNetwork=yes -ProtectSystem=strict -ProtectHome=yes +PrivateTmp=yes ProtectControlGroups=yes -ProtectKernelTunables=yes +ProtectHome=yes ProtectKernelModules=yes -MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes +ProtectKernelTunables=yes +ProtectSystem=strict RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 +RestrictNamespaces=yes +RestrictRealtime=yes SystemCallArchitectures=native -LockPersonality=yes -LogsDirectory=journal/remote +User=systemd-journal-remote +WatchdogSec=3min + +# If there are many split up journal files we need a lot of fds to access them +# all in parallel. +LimitNOFILE=@HIGH_RLIMIT_NOFILE@ [Install] Also=systemd-journal-remote.socket |