From 24da96a1bdd6fef2e23d7c23581d572209f8cca7 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 6 Aug 2020 14:50:38 +0200
Subject: units: turn on ProtectProc= wherever suitable

---
 units/systemd-hostnamed.service.in | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'units/systemd-hostnamed.service.in')

diff --git a/units/systemd-hostnamed.service.in b/units/systemd-hostnamed.service.in
index 1365d749ca..923f32f6db 100644
--- a/units/systemd-hostnamed.service.in
+++ b/units/systemd-hostnamed.service.in
@@ -23,11 +23,12 @@ NoNewPrivileges=yes
 PrivateDevices=yes
 PrivateNetwork=yes
 PrivateTmp=yes
+ProtectProc=invisible
 ProtectControlGroups=yes
 ProtectHome=yes
+ProtectKernelLogs=yes
 ProtectKernelModules=yes
 ProtectKernelTunables=yes
-ProtectKernelLogs=yes
 ProtectSystem=strict
 ReadWritePaths=/etc
 RestrictAddressFamilies=AF_UNIX
-- 
cgit v1.2.1