summaryrefslogtreecommitdiff
path: root/src/grp-hostname/systemd-hostnamed/systemd-hostnamed.service.in
diff options
context:
space:
mode:
Diffstat (limited to 'src/grp-hostname/systemd-hostnamed/systemd-hostnamed.service.in')
-rw-r--r--src/grp-hostname/systemd-hostnamed/systemd-hostnamed.service.in6
1 files changed, 5 insertions, 1 deletions
diff --git a/src/grp-hostname/systemd-hostnamed/systemd-hostnamed.service.in b/src/grp-hostname/systemd-hostnamed/systemd-hostnamed.service.in
index 0b03a589ea..edc5a1722a 100644
--- a/src/grp-hostname/systemd-hostnamed/systemd-hostnamed.service.in
+++ b/src/grp-hostname/systemd-hostnamed/systemd-hostnamed.service.in
@@ -13,12 +13,16 @@ Documentation=http://www.freedesktop.org/wiki/Software/systemd/hostnamed
[Service]
ExecStart=@rootlibexecdir@/systemd-hostnamed
BusName=org.freedesktop.hostname1
-CapabilityBoundingSet=CAP_SYS_ADMIN
WatchdogSec=3min
+CapabilityBoundingSet=CAP_SYS_ADMIN
PrivateTmp=yes
PrivateDevices=yes
PrivateNetwork=yes
ProtectSystem=yes
ProtectHome=yes
+ProtectControlGroups=yes
+ProtectKernelTunables=yes
MemoryDenyWriteExecute=yes
+RestrictRealtime=yes
+RestrictAddressFamilies=AF_UNIX
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io