[systemd.git] / units / systemd-importd.service.in

#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Virtual Machine and Container Download Service
Documentation=man:systemd-importd.service(8)
Documentation=man:org.freedesktop.import1(5)

[Service]
ExecStart={{ROOTLIBEXECDIR}}/systemd-importd
BusName=org.freedesktop.import1
KillMode=mixed
CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_SYS_ADMIN CAP_SETPCAP CAP_DAC_OVERRIDE CAP_LINUX_IMMUTABLE
NoNewPrivileges=yes
MemoryDenyWriteExecute=yes
ProtectHostname=yes
RestrictRealtime=yes
RestrictNamespaces=net
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallFilter=@system-service @mount
SystemCallErrorNumber=EPERM
SystemCallArchitectures=native
LockPersonality=yes
{{SERVICE_WATCHDOG}}
Commit	Line	Data
a032b68d	1	# SPDX-License-Identifier: LGPL-2.1-or-later
52ad194e	2	#
e735f4d4 MP	3	# This file is part of systemd.
	4	#
	5	# systemd is free software; you can redistribute it and/or modify it
	6	# under the terms of the GNU Lesser General Public License as published by
	7	# the Free Software Foundation; either version 2.1 of the License, or
	8	# (at your option) any later version.
	9
	10	[Unit]
	11	Description=Virtual Machine and Container Download Service
	12	Documentation=man:systemd-importd.service(8)
a032b68d	13	Documentation=man:org.freedesktop.import1(5)
e735f4d4 MP	14
e735f4d4 MP	15	[Service]
8b3d4ff0	16	ExecStart={{ROOTLIBEXECDIR}}/systemd-importd
e735f4d4	17	BusName=org.freedesktop.import1
e3bff60a	18	KillMode=mixed
8b3d4ff0	19	CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_SYS_ADMIN CAP_SETPCAP CAP_DAC_OVERRIDE CAP_LINUX_IMMUTABLE
8a584da2	20	NoNewPrivileges=yes
5a920b42	21	MemoryDenyWriteExecute=yes
bb4f798a	22	ProtectHostname=yes
8a584da2	23	RestrictRealtime=yes
81c58355	24	RestrictNamespaces=net
8a584da2	25	RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
b012e921 MB	26	SystemCallFilter=@system-service @mount
b012e921 MB	27	SystemCallErrorNumber=EPERM
81c58355	28	SystemCallArchitectures=native
f5e65279	29	LockPersonality=yes
8b3d4ff0	30	{{SERVICE_WATCHDOG}}