units: introduce systemd-udev-load-credentials.service

[thirdparty/systemd.git] / units / systemd-udevd.service.in

diff --git a/units/systemd-udevd.service.in b/units/systemd-udevd.service.in
index f3ebaa18a64a68f68ed8406892a4505e30a09b27..f4a44820880daaad11f98e1139e66c805860c250 100644 (file)
--- a/units/systemd-udevd.service.in
+++ b/units/systemd-udevd.service.in
@@ -1,4 +1,4 @@
-#  SPDX-License-Identifier: LGPL-2.1+
+#  SPDX-License-Identifier: LGPL-2.1-or-later
 #
 #  This file is part of systemd.
 #
@@ -8,36 +8,37 @@
 #  (at your option) any later version.
 
 [Unit]
-Description=udev Kernel Device Manager
+Description=Rule-based Manager for Device Events and Files
 Documentation=man:systemd-udevd.service(8) man:udev(7)
 DefaultDependencies=no
 After=systemd-sysusers.service systemd-hwdb-update.service
 Before=sysinit.target
+Wants=systemd-udev-load-credentials.service
 ConditionPathIsReadWrite=/sys
 
 [Service]
-DeviceAllow=block-* rwm
-DeviceAllow=char-* rwm
-Type=notify
-# Note that udev also adjusts the OOM score internally and will reset the value internally for its workers
+CapabilityBoundingSet=~CAP_SYS_TIME CAP_WAKE_ALARM
+Delegate=pids
+DelegateSubgroup=udev
+Type=notify-reload
+# Note that udev will reset the value internally for its workers
 OOMScoreAdjust=-1000
 Sockets=systemd-udevd-control.socket systemd-udevd-kernel.socket
 Restart=always
 RestartSec=0
-ExecStart=@rootlibexecdir@/systemd-udevd
-ExecReload=udevadm control --reload --timeout 0
+ExecStart={{LIBEXECDIR}}/systemd-udevd
 KillMode=mixed
 TasksMax=infinity
 PrivateMounts=yes
-ProtectClock=yes
 ProtectHostname=yes
 MemoryDenyWriteExecute=yes
 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
 RestrictRealtime=yes
 RestrictSUIDSGID=yes
-SystemCallFilter=@system-service @module @raw-io
+SystemCallFilter=@system-service @module @raw-io bpf
+SystemCallFilter=~@clock
 SystemCallErrorNumber=EPERM
 SystemCallArchitectures=native
 LockPersonality=yes
 IPAddressDeny=any
-@SERVICE_WATCHDOG@
+{{SERVICE_WATCHDOG}}