diff options
| author | Lennart Poettering <lennart@poettering.net> | 2014-05-17 20:33:47 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2014-05-18 20:52:49 +0900 |
| commit | a349eb10d3c3a31cd47198cbf08e4f0dfaffef1d (patch) | |
| tree | 8a3c4b4339d9cd99c7463c0d7fb2666e0f231066 /units | |
| parent | 2bcc2523711e69e6daa744641e56ed8b78646676 (diff) | |
timesyncd: run timesyncd as unpriviliged user "systemd-timesync" (but still with CAP_SYS_TIME)
Diffstat (limited to 'units')
| -rw-r--r-- | units/systemd-timesyncd.service.in | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index e279d1bc29..158438e627 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -16,7 +16,9 @@ Type=notify Restart=always RestartSec=0 ExecStart=@rootlibexecdir@/systemd-timesyncd -CapabilityBoundingSet=CAP_SYS_TIME +CapabilityBoundingSet=CAP_SYS_TIME CAP_SETUID CAP_SETGID CAP_SETPCAP +PrivateTmp=yes +PrivateDevices=yes [Install] WantedBy=multi-user.target |