diff options
Diffstat (limited to 'units/systemd-journald.service.in')
| -rw-r--r-- | units/systemd-journald.service.in | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in index 1c43d8c863..eb4bd938d7 100644 --- a/units/systemd-journald.service.in +++ b/units/systemd-journald.service.in @@ -16,7 +16,6 @@ After=systemd-journald.socket systemd-journald-dev-log.socket systemd-journald-a Before=sysinit.target [Service] -CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE DeviceAllow=char-* rw ExecStart=@rootlibexecdir@/systemd-journald FileDescriptorStoreMax=4224 @@ -42,6 +41,11 @@ SystemCallFilter=@system-service Type=notify @SERVICE_WATCHDOG@ +# In case you're wondering why CAP_SYS_PTRACE is needed, access to +# /proc/<pid>/exec requires this capability. Thus if this cap is missing +# _EXE/OBJECT_EXE fields will be missing from the journal entries. +CapabilityBoundingSet=CAP_SYS_ADMIN CAP_DAC_OVERRIDE CAP_SYS_PTRACE CAP_SYSLOG CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_CHOWN CAP_DAC_READ_SEARCH CAP_FOWNER CAP_SETUID CAP_SETGID CAP_MAC_OVERRIDE + # If there are many split up journal files we need a lot of fds to access them # all in parallel. LimitNOFILE=@HIGH_RLIMIT_NOFILE@ |