units: drop full paths for utilities in $PATH

[thirdparty/systemd.git] / units / systemd-udevd.service.in

diff --git a/units/systemd-udevd.service.in b/units/systemd-udevd.service.in
index 3b92c6a8662cb760d870bdf58c225b1cae59761a..5eee69933bde944c9afc7db3779997891ecb3a06 100644 (file)
--- a/units/systemd-udevd.service.in
+++ b/units/systemd-udevd.service.in
@@ -1,3 +1,5 @@
+#  SPDX-License-Identifier: LGPL-2.1+
+#
 #  This file is part of systemd.
 #
 #  systemd is free software; you can redistribute it and/or modify it
@@ -15,16 +17,24 @@ ConditionPathIsReadWrite=/sys
 
 [Service]
 Type=notify
+# Note that udev also adjusts the OOM score internally and will reset the value internally for its workers
 OOMScoreAdjust=-1000
 Sockets=systemd-udevd-control.socket systemd-udevd-kernel.socket
 Restart=always
 RestartSec=0
 ExecStart=@rootlibexecdir@/systemd-udevd
+ExecReload=udevadm control --reload --timeout 0
 KillMode=mixed
-WatchdogSec=3min
 TasksMax=infinity
-MountFlags=slave
+PrivateMounts=yes
+ProtectHostname=yes
 MemoryDenyWriteExecute=yes
-RestrictRealtime=yes
 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallFilter=@system-service @module @raw-io
+SystemCallErrorNumber=EPERM
 SystemCallArchitectures=native
+LockPersonality=yes
+IPAddressDeny=any
+@SERVICE_WATCHDOG@