summaryrefslogtreecommitdiff
path: root/units
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2014-05-17 20:33:47 +0200
committerLennart Poettering <lennart@poettering.net>2014-05-18 20:52:49 +0900
commita349eb10d3c3a31cd47198cbf08e4f0dfaffef1d (patch)
tree8a3c4b4339d9cd99c7463c0d7fb2666e0f231066 /units
parent2bcc2523711e69e6daa744641e56ed8b78646676 (diff)
timesyncd: run timesyncd as unpriviliged user "systemd-timesync" (but still with CAP_SYS_TIME)
Diffstat (limited to 'units')
-rw-r--r--units/systemd-timesyncd.service.in4
1 files changed, 3 insertions, 1 deletions
diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in
index e279d1bc29..158438e627 100644
--- a/units/systemd-timesyncd.service.in
+++ b/units/systemd-timesyncd.service.in
@@ -16,7 +16,9 @@ Type=notify
Restart=always
RestartSec=0
ExecStart=@rootlibexecdir@/systemd-timesyncd
-CapabilityBoundingSet=CAP_SYS_TIME
+CapabilityBoundingSet=CAP_SYS_TIME CAP_SETUID CAP_SETGID CAP_SETPCAP
+PrivateTmp=yes
+PrivateDevices=yes
[Install]
WantedBy=multi-user.target