]>
Commit | Line | Data |
---|---|---|
1 | # SPDX-License-Identifier: LGPL-2.1+ | |
2 | # | |
3 | # This file is part of systemd. | |
4 | # | |
5 | # systemd is free software; you can redistribute it and/or modify it | |
6 | # under the terms of the GNU Lesser General Public License as published by | |
7 | # the Free Software Foundation; either version 2.1 of the License, or | |
8 | # (at your option) any later version. | |
9 | ||
10 | [Unit] | |
11 | Description=Network Service | |
12 | Documentation=man:systemd-networkd.service(8) | |
13 | ConditionCapability=CAP_NET_ADMIN | |
14 | DefaultDependencies=no | |
15 | # systemd-udevd.service can be dropped once tuntap is moved to netlink | |
16 | After=systemd-udevd.service network-pre.target systemd-sysusers.service systemd-sysctl.service | |
17 | Before=network.target multi-user.target shutdown.target | |
18 | Conflicts=shutdown.target | |
19 | Wants=network.target | |
20 | ||
21 | [Service] | |
22 | AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW | |
23 | CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW | |
24 | ExecStart=!!@rootlibexecdir@/systemd-networkd | |
25 | LockPersonality=yes | |
26 | MemoryDenyWriteExecute=yes | |
27 | NoNewPrivileges=yes | |
28 | ProtectControlGroups=yes | |
29 | ProtectHome=yes | |
30 | ProtectKernelModules=yes | |
31 | ProtectSystem=strict | |
32 | Restart=on-failure | |
33 | RestartSec=0 | |
34 | RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET | |
35 | RestrictNamespaces=yes | |
36 | RestrictRealtime=yes | |
37 | RestrictSUIDSGID=yes | |
38 | RuntimeDirectory=systemd/netif | |
39 | RuntimeDirectoryPreserve=yes | |
40 | SystemCallArchitectures=native | |
41 | SystemCallErrorNumber=EPERM | |
42 | SystemCallFilter=@system-service | |
43 | Type=notify | |
44 | User=systemd-network | |
45 | WatchdogSec=3min | |
46 | ||
47 | [Install] | |
48 | WantedBy=multi-user.target | |
49 | Also=systemd-networkd.socket | |
50 | Alias=dbus-org.freedesktop.network1.service | |
51 | ||
52 | # We want to enable systemd-networkd-wait-online.service whenever this service | |
53 | # is enabled. systemd-networkd-wait-online.service has | |
54 | # WantedBy=network-online.target, so enabling it only has an effect if | |
55 | # network-online.target itself is enabled or pulled in by some other unit. | |
56 | Also=systemd-networkd-wait-online.service |