From 62aa29247c3d74bcec0607c347f2be23cd90675d Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 20 Mar 2019 19:52:20 +0100
Subject: units: turn on RestrictSUIDSGID= in most of our long-running daemons

---
 units/systemd-timedated.service.in | 1 +
 1 file changed, 1 insertion(+)

(limited to 'units/systemd-timedated.service.in')

diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in
index 46ee8c894d..df546f471f 100644
--- a/units/systemd-timedated.service.in
+++ b/units/systemd-timedated.service.in
@@ -31,6 +31,7 @@ ReadWritePaths=/etc
 RestrictAddressFamilies=AF_UNIX
 RestrictNamespaces=yes
 RestrictRealtime=yes
+RestrictSUIDSGID=yes
 SystemCallArchitectures=native
 SystemCallErrorNumber=EPERM
 SystemCallFilter=@system-service @clock
-- 
cgit v1.2.1