diff options
Diffstat (limited to 'units/systemd-journald.service.in')
-rw-r--r-- | units/systemd-journald.service.in | 35 |
1 files changed, 17 insertions, 18 deletions
diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 52939e6820..4684f095c0 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -16,27 +16,26 @@ After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-a Before=sysinit.target [Service] -Type=notify -Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE ExecStart=@rootlibexecdir@/systemd-journald -Restart=always -RestartSec=0 -StandardOutput=null -WatchdogSec=3min FileDescriptorStoreMax=4224 -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE +IPAddressDeny=any +LockPersonality=yes MemoryDenyWriteExecute=yes -RestrictRealtime=yes -RestrictNamespaces=yes +NoNewPrivileges=yes +Restart=always +RestartSec=0 RestrictAddressFamilies=AF_UNIX AF_NETLINK -SystemCallFilter=@system-service -SystemCallErrorNumber=EPERM +RestrictNamespaces=yes +RestrictRealtime=yes +Sockets=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-audit.socket +StandardOutput=null SystemCallArchitectures=native -LockPersonality=yes -IPAddressDeny=any +SystemCallErrorNumber=EPERM +SystemCallFilter=@system-service +Type=notify +WatchdogSec=3min -# Increase the default a bit in order to allow many simultaneous -# services being run since we keep one fd open per service. Also, when -# flushing journal files to disk, we might need a lot of fds when many -# journal files are combined. -LimitNOFILE=16384 +# If there are many split up journal files we need a lot of fds to access them +# all in parallel. +LimitNOFILE=@HIGH_RLIMIT_NOFILE@ |