From 62aa29247c3d74bcec0607c347f2be23cd90675d Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 20 Mar 2019 19:52:20 +0100
Subject: units: turn on RestrictSUIDSGID= in most of our long-running daemons

---
 units/systemd-udevd.service.in | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'units/systemd-udevd.service.in')

diff --git a/units/systemd-udevd.service.in b/units/systemd-udevd.service.in
index fb98ca4d43..e8a76cc018 100644
--- a/units/systemd-udevd.service.in
+++ b/units/systemd-udevd.service.in
@@ -28,8 +28,9 @@ TasksMax=infinity
 PrivateMounts=yes
 ProtectHostname=yes
 MemoryDenyWriteExecute=yes
-RestrictRealtime=yes
 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
 SystemCallFilter=@system-service @module @raw-io
 SystemCallErrorNumber=EPERM
 SystemCallArchitectures=native
-- 
cgit v1.2.1