|
|
@@ -31,8 +31,6 @@ ProtectHome=true |
|
|
|
ProtectSystem=full |
|
|
|
; Sets up a new /dev mount for the process and only adds API pseudo devices like /dev/null, /dev/zero or /dev/random but not physical devices. Disabled by default because it may not work on devices like the Raspberry Pi. |
|
|
|
PrivateDevices=false |
|
|
|
; Ensures that the service process and all its children can never gain new privileges through execve(). |
|
|
|
NoNewPrivileges=true |
|
|
|
; Drops the sysadmin capability from the daemon. |
|
|
|
CapabilityBoundingSet=~CAP_SYS_ADMIN |
|
|
|
|
|
|
|