DefaultDependencies=no
After=systemd-sysusers.service systemd-hwdb-update.service
Before=sysinit.target
+Wants=systemd-udev-load-credentials.service
ConditionPathIsReadWrite=/sys
[Service]
-DeviceAllow=block-* rwm
-DeviceAllow=char-* rwm
-Type=notify
+CapabilityBoundingSet=~CAP_SYS_TIME CAP_WAKE_ALARM
+Delegate=pids
+DelegateSubgroup=udev
+Type=notify-reload
# Note that udev will reset the value internally for its workers
OOMScoreAdjust=-1000
Sockets=systemd-udevd-control.socket systemd-udevd-kernel.socket
Restart=always
RestartSec=0
-ExecStart={{ROOTLIBEXECDIR}}/systemd-udevd
-ExecReload=udevadm control --reload --timeout 0
+ExecStart={{LIBEXECDIR}}/systemd-udevd
KillMode=mixed
TasksMax=infinity
PrivateMounts=yes
-ProtectClock=yes
ProtectHostname=yes
MemoryDenyWriteExecute=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallFilter=@system-service @module @raw-io bpf
+SystemCallFilter=~@clock
SystemCallErrorNumber=EPERM
SystemCallArchitectures=native
LockPersonality=yes