test/fuzz/fuzz-unit-file/systemd-resolved.service

   1 service
   2 #  SPDX-License-Identifier: LGPL-2.1+
   3 #
   4 #  This file is part of systemd.
   5 #
   6 #  systemd is free software; you can redistribute it and/or modify it
   7 #  under the terms of the GNU Lesser General Public License as published by
   8 #  the Free Software Foundation; either version 2.1 of the License, or
   9 #  (at your option) any later version.
  10
  11 [Unit]
  12 Description=Network Name Resolution
  13 Documentation=man:systemd-resolved.service(8)
  14 Documentation=https://www.freedesktop.org/wiki/Software/systemd/resolved
  15 Documentation=https://www.freedesktop.org/wiki/Software/systemd/writing-network-configuration-managers
  16 Documentation=https://www.freedesktop.org/wiki/Software/systemd/writing-resolver-clients
  17 DefaultDependencies=no
  18 After=systemd-sysusers.service systemd-networkd.service
  19 Before=network.target nss-lookup.target shutdown.target
  20 Conflicts=shutdown.target
  21 Wants=nss-lookup.target
  22
  23 [Service]
  24 Type=notify
  25 Restart=always
  26 RestartSec=0
  27 ExecStart=!!/usr/lib/systemd/systemd-resolved
  28 WatchdogSec=3min
  29 User=systemd-resolve
  30 CapabilityBoundingSet=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
  31 AmbientCapabilities=CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
  32 PrivateTmp=yes
  33 PrivateDevices=yes
  34 ProtectSystem=strict
  35 ProtectHome=yes
  36 ProtectControlGroups=yes
  37 ProtectKernelTunables=yes
  38 ProtectKernelModules=yes
  39 MemoryDenyWriteExecute=yes
  40 RestrictRealtime=yes
  41 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
  42 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
  43 SystemCallArchitectures=native
  44 LockPersonality=yes
  45 RuntimeDirectory=systemd/resolve
  46 RuntimeDirectoryPreserve=yes
  47
  48 [Install]
  49 WantedBy=multi-user.target
  50 Alias=dbus-org.freedesktop.resolve1.service