diff options
| -rw-r--r-- | units/systemd-coredump@.service.in | 3 | ||||
| -rw-r--r-- | units/systemd-hostnamed.service.in | 3 | ||||
| -rw-r--r-- | units/systemd-importd.service.in | 3 | ||||
| -rw-r--r-- | units/systemd-journald.service.in | 3 | ||||
| -rw-r--r-- | units/systemd-localed.service.in | 3 | ||||
| -rw-r--r-- | units/systemd-logind.service.in | 3 | ||||
| -rw-r--r-- | units/systemd-machined.service.in | 3 | ||||
| -rw-r--r-- | units/systemd-networkd.service.in | 3 | ||||
| -rw-r--r-- | units/systemd-resolved.service.in | 3 | ||||
| -rw-r--r-- | units/systemd-timedated.service.in | 3 | ||||
| -rw-r--r-- | units/systemd-timesyncd.service.in | 3 | ||||
| -rw-r--r-- | units/systemd-udevd.service.in | 2 |
12 files changed, 24 insertions, 11 deletions
diff --git a/units/systemd-coredump@.service.in b/units/systemd-coredump@.service.in index 68fa55c807..215696ecd1 100644 --- a/units/systemd-coredump@.service.in +++ b/units/systemd-coredump@.service.in @@ -33,7 +33,8 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes IPAddressDeny=any diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in index 993134f3d6..da74b4fe8b 100644 --- a/units/systemd-hostnamed.service.in +++ b/units/systemd-hostnamed.service.in @@ -29,7 +29,8 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap +SystemCallFilter=@system-service sethostname +SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes IPAddressDeny=any diff --git a/units/systemd-importd.service.in b/units/systemd-importd.service.in index 8e93c2d524..20704a8232 100644 --- a/units/systemd-importd.service.in +++ b/units/systemd-importd.service.in @@ -23,6 +23,7 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=net RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io @reboot @swap +SystemCallFilter=@system-service @mount +SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index df76fe4226..52939e6820 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -29,7 +29,8 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes IPAddressDeny=any diff --git a/units/systemd-localed.service.in b/units/systemd-localed.service.in index ba8a08f3b4..a24e61a0cd 100644 --- a/units/systemd-localed.service.in +++ b/units/systemd-localed.service.in @@ -29,7 +29,8 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes IPAddressDeny=any diff --git a/units/systemd-logind.service.in b/units/systemd-logind.service.in index 168fc007b0..5e090bcf23 100644 --- a/units/systemd-logind.service.in +++ b/units/systemd-logind.service.in @@ -30,7 +30,8 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes IPAddressDeny=any diff --git a/units/systemd-machined.service.in b/units/systemd-machined.service.in index f9e789db42..1200a90a61 100644 --- a/units/systemd-machined.service.in +++ b/units/systemd-machined.service.in @@ -23,7 +23,8 @@ CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_C MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @obsolete @raw-io @reboot @swap +SystemCallFilter=@system-service @mount +SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes IPAddressDeny=any diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index adb219a01d..371ab3a9cf 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -35,7 +35,8 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes RuntimeDirectory=systemd/netif diff --git a/units/systemd-resolved.service.in b/units/systemd-resolved.service.in index 7b92735f19..9982ecebff 100644 --- a/units/systemd-resolved.service.in +++ b/units/systemd-resolved.service.in @@ -38,7 +38,8 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap +SystemCallFilter=@system-service +SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes RuntimeDirectory=systemd/resolve diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in index cf13e40ced..906bb4326c 100644 --- a/units/systemd-timedated.service.in +++ b/units/systemd-timedated.service.in @@ -27,7 +27,8 @@ MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX -SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap +SystemCallFilter=@system-service @clock +SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes IPAddressDeny=any diff --git a/units/systemd-timesyncd.service.in b/units/systemd-timesyncd.service.in index 6bfe28627b..4a490b6e16 100644 --- a/units/systemd-timesyncd.service.in +++ b/units/systemd-timesyncd.service.in @@ -38,7 +38,8 @@ RestrictRealtime=yes RestrictNamespaces=yes RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 RuntimeDirectory=systemd/timesync -SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap +SystemCallFilter=@system-service @clock +SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes StateDirectory=systemd/timesync diff --git a/units/systemd-udevd.service.in b/units/systemd-udevd.service.in index 2b9fa69d9b..6a3814e5d9 100644 --- a/units/systemd-udevd.service.in +++ b/units/systemd-udevd.service.in @@ -29,6 +29,8 @@ PrivateMounts=yes MemoryDenyWriteExecute=yes RestrictRealtime=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 +SystemCallFilter=@system-service @module @raw-io +SystemCallErrorNumber=EPERM SystemCallArchitectures=native LockPersonality=yes IPAddressDeny=any |