From a349eb10d3c3a31cd47198cbf08e4f0dfaffef1d Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Sat, 17 May 2014 20:33:47 +0200
Subject: timesyncd: run timesyncd as unpriviliged user "systemd-timesync" (but
 still with CAP_SYS_TIME)

---
 units/systemd-timesyncd.service.in | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'units/systemd-timesyncd.service.in')

diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in
index e279d1bc29..158438e627 100644
--- a/units/systemd-timesyncd.service.in
+++ b/units/systemd-timesyncd.service.in
@@ -16,7 +16,9 @@ Type=notify
 Restart=always
 RestartSec=0
 ExecStart=@rootlibexecdir@/systemd-timesyncd
-CapabilityBoundingSet=CAP_SYS_TIME
+CapabilityBoundingSet=CAP_SYS_TIME CAP_SETUID CAP_SETGID CAP_SETPCAP
+PrivateTmp=yes
+PrivateDevices=yes
 
 [Install]
 WantedBy=multi-user.target
-- 
cgit v1.2.3-54-g00ecf