units: set LockPersonality= for all our long-running services (#6819)

[thirdparty/systemd.git] / units / systemd-timedated.service.in

diff --git a/units/systemd-timedated.service.in b/units/systemd-timedated.service.in
index 2b5f0744c9bfa7e7752bbaa896c5cf8c53136b0e..9fca1d1905d039a5e1c7813fa953ee1acdb7f146 100644 (file)
--- a/units/systemd-timedated.service.in
+++ b/units/systemd-timedated.service.in
@@ -27,4 +27,5 @@ RestrictNamespaces=yes
 RestrictAddressFamilies=AF_UNIX
 SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
 SystemCallArchitectures=native
+LockPersonality=yes
 ReadWritePaths=/etc