Merge pull request #12378 from rbalint/vt-kbd-reset-check

[thirdparty/systemd.git] / units / systemd-udevd.service.in

diff --git a/units/systemd-udevd.service.in b/units/systemd-udevd.service.in
index 8557522e7b818204b6eed5dfd5543f4d72c1cfa3..e8a76cc0184258a04a70a4ee30b6f4cf3a288079 100644 (file)
--- a/units/systemd-udevd.service.in
+++ b/units/systemd-udevd.service.in
@@ -25,10 +25,14 @@ ExecStart=@rootlibexecdir@/systemd-udevd
 KillMode=mixed
 WatchdogSec=3min
 TasksMax=infinity
-MountFlags=slave
+PrivateMounts=yes
+ProtectHostname=yes
 MemoryDenyWriteExecute=yes
-RestrictRealtime=yes
 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallFilter=@system-service @module @raw-io
+SystemCallErrorNumber=EPERM
 SystemCallArchitectures=native
 LockPersonality=yes
 IPAddressDeny=any