fdo-mirrors/NetworkManager
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git synced 2026-05-06 11:28:32 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

merge: branch 'lr/systemd-unit-lockdown'

Browse source 
data/NetworkManager.service: restrict the unit some more

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2062
This commit is contained in:
Beniamino Galvani 2026-02-27 08:46:04 +00:00
commit b7d9625ae1
1 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
data/NetworkManager.service.in
View file

@ -21,8 +21,16 @@ TimeoutStartSec=600
CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_BPF CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_NET_RAW CAP_BPF CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_MODULE CAP_AUDIT_WRITE CAP_KILL CAP_SYS_CHROOT
ProtectSystem=true PrivateTmp=true
ProtectClock=true
ProtectControlGroups=true
ProtectHome=read-only ProtectHome=read-only
ProtectKernelLogs=true
ProtectSystem=true
RestrictRealtime=true
RestrictSUIDSGID=true
# We require file descriptors for DHCP etc. When activating many interfaces, # We require file descriptors for DHCP etc. When activating many interfaces,
# the default limit of 1024 is easily reached. # the default limit of 1024 is easily reached.