[thirdparty/systemd.git] / units / systemd-machined.service.in

#  SPDX-License-Identifier: LGPL-2.1+
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Virtual Machine and Container Registration Service
Documentation=man:systemd-machined.service(8)
Documentation=https://www.freedesktop.org/wiki/Software/systemd/machined
Wants=machine.slice
After=machine.slice
RequiresMountsFor=/var/lib/machines

[Service]
BusName=org.freedesktop.machine1
CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD
ExecStart=@rootlibexecdir@/systemd-machined
IPAddressDeny=any
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
ProtectHostname=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
RestrictRealtime=yes
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service @mount
WatchdogSec=3min

# Note that machined cannot be placed in a mount namespace, since it
# needs access to the host's mount namespace in order to implement the
# "machinectl bind" operation.
Commit	Line	Data
a7df2d1e ZJS	1	# SPDX-License-Identifier: LGPL-2.1+
a7df2d1e ZJS	2	#
1ee306e1 LP	3	# This file is part of systemd.
	4	#
	5	# systemd is free software; you can redistribute it and/or modify it
	6	# under the terms of the GNU Lesser General Public License as published by
	7	# the Free Software Foundation; either version 2.1 of the License, or
	8	# (at your option) any later version.
	9
	10	[Unit]
	11	Description=Virtual Machine and Container Registration Service
	12	Documentation=man:systemd-machined.service(8)
16a5d412	13	Documentation=https://www.freedesktop.org/wiki/Software/systemd/machined
1ee306e1 LP	14	Wants=machine.slice
1ee306e1 LP	15	After=machine.slice
2221c17a	16	RequiresMountsFor=/var/lib/machines
1ee306e1 LP	17
1ee306e1 LP	18	[Service]
1ee306e1	19	BusName=org.freedesktop.machine1
0c28d51a	20	CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD
3ca9940c LP	21	ExecStart=@rootlibexecdir@/systemd-machined
	22	IPAddressDeny=any
	23	LockPersonality=yes
40652ca4	24	MemoryDenyWriteExecute=yes
3ca9940c	25	NoNewPrivileges=yes
99894b86	26	ProtectHostname=yes
0c28d51a	27	RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
3ca9940c	28	RestrictRealtime=yes
7f396e5f	29	SystemCallArchitectures=native
3ca9940c LP	30	SystemCallErrorNumber=EPERM
	31	SystemCallFilter=@system-service @mount
	32	WatchdogSec=3min
90adaa25 LP	33
	34	# Note that machined cannot be placed in a mount namespace, since it
	35	# needs access to the host's mount namespace in order to implement the
	36	# "machinectl bind" operation.