diff options
| -rw-r--r-- | units/systemd-hostnamed.service.in | 1 | ||||
| -rw-r--r-- | units/systemd-importd.service.in | 1 | ||||
| -rw-r--r-- | units/systemd-journal-gatewayd.service.in | 1 | ||||
| -rw-r--r-- | units/systemd-journal-remote.service.in | 1 | ||||
| -rw-r--r-- | units/systemd-journal-upload.service.in | 1 | ||||
| -rw-r--r-- | units/systemd-journald.service.in | 1 | ||||
| -rw-r--r-- | units/systemd-localed.service.in | 1 | ||||
| -rw-r--r-- | units/systemd-logind.service.in | 1 | ||||
| -rw-r--r-- | units/systemd-timedated.service.in | 1 | ||||
| -rw-r--r-- | units/systemd-timesyncd.service.in | 1 |
10 files changed, 10 insertions, 0 deletions
diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index 89d942b072..8a551403cf 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -24,6 +24,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native diff --git a/units/systemd-importd.service.in b/units/systemd-importd.service.in index 2a8a683d95..de2431739f 100644 --- a/units/systemd-importd.service.in +++ b/units/systemd-importd.service.in @@ -19,6 +19,7 @@ CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD CAP_SETFCAP CAP_ NoNewPrivileges=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=net RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io SystemCallArchitectures=native diff --git a/units/systemd-journal-gatewayd.service.in b/units/systemd-journal-gatewayd.service.in index b0b934deb2..677cb2a04b 100644 --- a/units/systemd-journal-gatewayd.service.in +++ b/units/systemd-journal-gatewayd.service.in @@ -24,6 +24,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallArchitectures=native diff --git a/units/systemd-journal-remote.service.in b/units/systemd-journal-remote.service.in index bc384b8382..cab7778ddc 100644 --- a/units/systemd-journal-remote.service.in +++ b/units/systemd-journal-remote.service.in @@ -24,6 +24,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallArchitectures=native diff --git a/units/systemd-journal-upload.service.in b/units/systemd-journal-upload.service.in index d28a62bb35..f539c7dc1f 100644 --- a/units/systemd-journal-upload.service.in +++ b/units/systemd-journal-upload.service.in @@ -24,6 +24,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallArchitectures=native diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index b2e7eeeda3..adabedd977 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -26,6 +26,7 @@ FileDescriptorStoreMax=1024 CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index af2cdfffbe..1b6c163ef4 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -24,6 +24,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index fcbfd1debe..93abeb3dca 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -27,6 +27,7 @@ WatchdogSec=3min CapabilityBoundingSet=CAP_SYS_ADMIN CAP_MAC_ADMIN CAP_AUDIT_CONTROL CAP_CHOWN CAP_KILL CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_FOWNER CAP_SYS_TTY_CONFIG MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io SystemCallArchitectures=native diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index 7608d9da28..26756d6e01 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -22,6 +22,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 46b81ebab3..5eb3f2362f 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -32,6 +32,7 @@ ProtectControlGroups=yes ProtectKernelTunables=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes +RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io SystemCallArchitectures=native |