From cabc1c6d7adae658a2966a4b02a6faabb803e92b Mon Sep 17 00:00:00 2001 From: Topi Miettinen Date: Thu, 2 Apr 2020 21:18:11 +0300 Subject: units: add ProtectClock=yes Add `ProtectClock=yes` to systemd units. Since it implies certain `DeviceAllow=` rules, make sure that the units have `DeviceAllow=` rules so they are still able to access other devices. Exclude timesyncd and timedated. --- units/systemd-udevd.service.in | 3 +++ 1 file changed, 3 insertions(+) (limited to 'units/systemd-udevd.service.in') diff --git a/units/systemd-udevd.service.in b/units/systemd-udevd.service.in index 5eee69933b..f3ebaa18a6 100644 --- a/units/systemd-udevd.service.in +++ b/units/systemd-udevd.service.in @@ -16,6 +16,8 @@ Before=sysinit.target ConditionPathIsReadWrite=/sys [Service] +DeviceAllow=block-* rwm +DeviceAllow=char-* rwm Type=notify # Note that udev also adjusts the OOM score internally and will reset the value internally for its workers OOMScoreAdjust=-1000 @@ -27,6 +29,7 @@ ExecReload=udevadm control --reload --timeout 0 KillMode=mixed TasksMax=infinity PrivateMounts=yes +ProtectClock=yes ProtectHostname=yes MemoryDenyWriteExecute=yes RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 -- cgit v1.2.1