[thirdparty/systemd.git] / units / systemd-machined.service.in

#  SPDX-License-Identifier: LGPL-2.1+
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Virtual Machine and Container Registration Service
Documentation=man:systemd-machined.service(8)
Documentation=man:org.freedesktop.machine1(5)

Wants=machine.slice
After=machine.slice
RequiresMountsFor=/var/lib/machines

[Service]
BusName=org.freedesktop.machine1
CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD
ExecStart=@rootlibexecdir@/systemd-machined
IPAddressDeny=any
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
ProtectHostname=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
RestrictRealtime=yes
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service @mount
@SERVICE_WATCHDOG@

# Note that machined cannot be placed in a mount namespace, since it
# needs access to the host's mount namespace in order to implement the
# "machinectl bind" operation.
Commit	Line	Data
a7df2d1e ZJS	1	# SPDX-License-Identifier: LGPL-2.1+
a7df2d1e ZJS	2	#
1ee306e1 LP	3	# This file is part of systemd.
	4	#
	5	# systemd is free software; you can redistribute it and/or modify it
	6	# under the terms of the GNU Lesser General Public License as published by
	7	# the Free Software Foundation; either version 2.1 of the License, or
	8	# (at your option) any later version.
	9
	10	[Unit]
	11	Description=Virtual Machine and Container Registration Service
	12	Documentation=man:systemd-machined.service(8)
21006e0e ZJS	13	Documentation=man:org.freedesktop.machine1(5)
21006e0e ZJS	14
1ee306e1 LP	15	Wants=machine.slice
1ee306e1 LP	16	After=machine.slice
2221c17a	17	RequiresMountsFor=/var/lib/machines
1ee306e1 LP	18
1ee306e1 LP	19	[Service]
1ee306e1	20	BusName=org.freedesktop.machine1
0c28d51a	21	CapabilityBoundingSet=CAP_KILL CAP_SYS_PTRACE CAP_SYS_ADMIN CAP_SETGID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE CAP_CHOWN CAP_FOWNER CAP_FSETID CAP_MKNOD
3ca9940c LP	22	ExecStart=@rootlibexecdir@/systemd-machined
	23	IPAddressDeny=any
	24	LockPersonality=yes
40652ca4	25	MemoryDenyWriteExecute=yes
3ca9940c	26	NoNewPrivileges=yes
99894b86	27	ProtectHostname=yes
0c28d51a	28	RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
3ca9940c	29	RestrictRealtime=yes
7f396e5f	30	SystemCallArchitectures=native
3ca9940c LP	31	SystemCallErrorNumber=EPERM
3ca9940c LP	32	SystemCallFilter=@system-service @mount
21d0dd5a	33	@SERVICE_WATCHDOG@
90adaa25 LP	34
	35	# Note that machined cannot be placed in a mount namespace, since it
	36	# needs access to the host's mount namespace in order to implement the
	37	# "machinectl bind" operation.