examples: improve systemd unit files

Add the PrivateTmp, ProtectHome, and ProtectSystem directives to better
secure the system from chronyd. It's taken from the Debian chrony
package.

diff --git a/examples/chrony-wait.service b/examples/chrony-wait.service
index f629ad9b2aee18ef99e774268b60de28417024c1..0f5e2e7613e9224f2625c6630d60d945d464221c 100644 (file)
--- a/examples/chrony-wait.service
+++ b/examples/chrony-wait.service
@@ -1,5 +1,6 @@
 [Unit]
 Description=Wait for chrony to synchronize system clock
+Documentation=man:chronyc(1)
 After=chronyd.service
 Requires=chronyd.service
 Before=time-sync.target

diff --git a/examples/chronyd.service b/examples/chronyd.service
index 927a478fa28e35b7271321c5ad3bac790b27a0b2..4ffe3b194fc9708fbac133bb0f922c239afbcba3 100644 (file)
--- a/examples/chronyd.service
+++ b/examples/chronyd.service
@@ -10,6 +10,9 @@ Type=forking
 PIDFile=/var/run/chronyd.pid
 EnvironmentFile=-/etc/sysconfig/chronyd
 ExecStart=/usr/sbin/chronyd $OPTIONS
+PrivateTmp=yes
+ProtectHome=yes
+ProtectSystem=full
 
 [Install]
 WantedBy=multi-user.target