2 Description=Test CAP_SYS_MODULE for ProtectKernelModules=yes
5 ProtectKernelModules=yes
6 # sed: remove dropped capabilities (cap_xxx-[epi]) from the output
7 ExecStart=/bin/sh -x -c '! capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_sys_module'