update TODO

diff --git a/TODO b/TODO
index 4526f8e1bed0cc8c13dd5d39c0ea9d33e3bd7708..c940cb69ad9a5b4e7fa69f58288421582cc7d7d4 100644 (file)
--- a/TODO
+++ b/TODO
@@ -129,6 +129,8 @@ Deprecations and removals:
 
 Features:
 
+* tmpfiles snippet that locks down /etc/credstore/ and friends, just in case.
+
 * split out execute.c into new "systemd-executor" binary. Then make PID 1 fork
   that off via vfork(), and then let that executor do the hard work. Ultimately
   the executor then gets replaced by the real binary sooner or later. Reason: