Merge a624cb6c15
into 50e8d2ed00
This commit is contained in:
commit
b72066d8ab
1 changed files with 26 additions and 0 deletions
|
@ -9,5 +9,31 @@ Environment=daemon_interval=5m
|
||||||
ExecStart=/usr/bin/ddclient --daemon ${daemon_interval} --foreground
|
ExecStart=/usr/bin/ddclient --daemon ${daemon_interval} --foreground
|
||||||
Restart=on-failure
|
Restart=on-failure
|
||||||
|
|
||||||
|
SystemCallArchitectures=native
|
||||||
|
SystemCallFilter=@system-service
|
||||||
|
SystemCallFilter=~ @privileged @resources
|
||||||
|
|
||||||
|
CapabilityBoundingSet=
|
||||||
|
NoNewPrivileges=yes
|
||||||
|
|
||||||
|
ProtectControlGroups=yes
|
||||||
|
ProtectKernelTunables=yes
|
||||||
|
ProtectKernelModules=yes
|
||||||
|
ProtectKernelLogs=yes
|
||||||
|
ProtectProc=invisible
|
||||||
|
ProtectClock=yes
|
||||||
|
ProtectHostname=yes
|
||||||
|
|
||||||
|
ProtectSystem=yes
|
||||||
|
ProtectHome=yes
|
||||||
|
PrivateTmp=yes
|
||||||
|
PrivateDevices=yes
|
||||||
|
MemoryDenyWriteExecute=true
|
||||||
|
|
||||||
|
RestrictRealtime=yes
|
||||||
|
RestrictSUIDSGID=yes
|
||||||
|
RestrictNamespaces=yes
|
||||||
|
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||||
|
|
||||||
[Install]
|
[Install]
|
||||||
WantedBy=multi-user.target
|
WantedBy=multi-user.target
|
||||||
|
|
Loading…
Reference in a new issue