# (at your option) any later version.
[Unit]
-Description=udev Kernel Device Manager
+Description=Rule-based Manager for Device Events and Files
Documentation=man:systemd-udevd.service(8) man:udev(7)
DefaultDependencies=no
After=systemd-sysusers.service systemd-hwdb-update.service
ConditionPathIsReadWrite=/sys
[Service]
+DeviceAllow=block-* rwm
+DeviceAllow=char-* rwm
Type=notify
+# Note that udev also adjusts the OOM score internally and will reset the value internally for its workers
OOMScoreAdjust=-1000
Sockets=systemd-udevd-control.socket systemd-udevd-kernel.socket
Restart=always
RestartSec=0
ExecStart=@rootlibexecdir@/systemd-udevd
+ExecReload=udevadm control --reload --timeout 0
KillMode=mixed
-WatchdogSec=3min
TasksMax=infinity
PrivateMounts=yes
+ProtectClock=yes
+ProtectHostname=yes
MemoryDenyWriteExecute=yes
-RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallFilter=@system-service @module @raw-io
+SystemCallErrorNumber=EPERM
SystemCallArchitectures=native
LockPersonality=yes
IPAddressDeny=any
+@SERVICE_WATCHDOG@