FreedomBox/plinth/modules/storage/data/lib/systemd/system/freedombox-udiskie.service
James Valleroy c91939710b
storage: Add systemd sandboxing features to udiskie service
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2019-12-29 17:49:10 -08:00

39 lines
1.1 KiB
Desktop File

#
# This file is part of FreedomBox.
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
[Unit]
Description=handle automounting
Documentation=man:udiskie(1)
[Service]
ExecStart=/usr/bin/udiskie
LockPersonality=yes
PrivateTmp=yes
PrivateUsers=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectSystem=full
RestrictAddressFamilies=AF_UNIX
RestrictRealtime=yes
SystemCallArchitectures=native
[Install]
WantedBy=multi-user.target