power-profiles-daemon/data/power-profiles-daemon.service.in

[Unit]
Description=Power Profiles daemon
Conflicts=tuned.service tlp.service auto-cpufreq.service system76-power.service
After=multi-user.target display-manager.target

[Service]
Type=dbus
BusName=org.freedesktop.UPower.PowerProfiles
# To enable debugging add a -vv to the ExecStart line
ExecStart=@libexecdir@/power-profiles-daemon
Restart=on-failure
# This always corresponds to /var/lib/power-profiles-daemon
StateDirectory=power-profiles-daemon

# Lockdown
CapabilityBoundingSet=CAP_SYS_ADMIN
DevicePolicy=closed
IPAddressDeny=any
KeyringMode=private
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
PrivateNetwork=yes
PrivateUsers=yes
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectProc=invisible
ProtectSystem=strict
RemoveIPC=yes
RestrictAddressFamilies=AF_UNIX AF_LOCAL AF_NETLINK
MemoryDenyWriteExecute=true
RestrictRealtime=true
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallFilter=@system-service
SystemCallFilter=~@resources @privileged
SystemCallErrorNumber=EPERM
SystemCallArchitectures=native

[Install]
WantedBy=graphical.target
power-profiles-daemon 2020-07-06 12:37:41 +02:00			`[Unit]`
			`Description=Power Profiles daemon`
README: Add mention of system76-power Closes: #26 2021-08-06 18:34:37 +02:00			`Conflicts=tuned.service tlp.service auto-cpufreq.service system76-power.service`
Start the daemon after multi-user.target instead of before It's not critical for the boot process in any way, and this should help with any race conditions form kernel modules still setting up anything related devices after the initial device uevent. 2024-08-04 13:27:47 -05:00			`After=multi-user.target display-manager.target`
power-profiles-daemon 2020-07-06 12:37:41 +02:00
			`[Service]`
			`Type=dbus`
cleanup: Use UPower namespace as default DBus name preserving old one Expose the daemon as 'org.freedesktop.UPower.PowerProfiles' by default but we also own the old 'net.hadess.PowerProfiles' name for compatibility resons. Also dbus objects are now registered also in the path /org/freedesktop/UPower/PowerProfiles and they implement the org.freedesktop.UPower.PowerProfiles interface. Even in this case we preserve the compatibility with the old ones. To make this switch as most reliable as possible, the code is now generated for dbus configuration files preserving the previous ones as base. Tests are now performed checking both names, to ensure again that we're not breaking the expectations for the old APIs consumers. 2024-02-13 20:28:22 +01:00			`BusName=org.freedesktop.UPower.PowerProfiles`
Distinguish differently between -v and -vv Set the default log level to MESSAGE. If launched with -v, upgrade to INFO. If launched with -vv, upgrade to DEBUG. 2024-04-02 23:01:51 -05:00			`# To enable debugging add a -vv to the ExecStart line`
power-profiles-daemon 2020-07-06 12:37:41 +02:00			`ExecStart=@libexecdir@/power-profiles-daemon`
data: Tell service whether to restart 2020-09-09 13:00:27 +02:00			`Restart=on-failure`
main: Implement profile persistence Save the current user-selected profile in /var/lib/power-profiles-daemon/state.ini Closes: #23 2021-07-05 17:08:35 +02:00			`# This always corresponds to /var/lib/power-profiles-daemon`
			`StateDirectory=power-profiles-daemon`
power-profiles-daemon 2020-07-06 12:37:41 +02:00
			`# Lockdown`
Apply additional systemd hardening options 2024-04-12 14:08:30 -05:00			`CapabilityBoundingSet=CAP_SYS_ADMIN`
Update Systemd security settings 2024-03-26 20:32:10 +00:00			`DevicePolicy=closed`
Apply additional systemd hardening options 2024-04-12 14:08:30 -05:00			`IPAddressDeny=any`
Update Systemd security settings 2024-03-26 20:32:10 +00:00			`KeyringMode=private`
			`LockPersonality=yes`
			`MemoryDenyWriteExecute=yes`
			`NoNewPrivileges=yes`
			`PrivateDevices=yes`
			`PrivateTmp=yes`
Apply additional systemd hardening options 2024-04-12 14:08:30 -05:00			`PrivateNetwork=yes`
			`PrivateUsers=yes`
Update Systemd security settings 2024-03-26 20:32:10 +00:00			`ProtectClock=yes`
			`ProtectControlGroups=yes`
			`ProtectHome=yes`
			`ProtectHostname=yes`
			`ProtectKernelLogs=yes`
			`ProtectKernelModules=yes`
			`ProtectProc=invisible`
power-profiles-daemon 2020-07-06 12:37:41 +02:00			`ProtectSystem=strict`
Update Systemd security settings 2024-03-26 20:32:10 +00:00			`RemoveIPC=yes`
power-profiles-daemon 2020-07-06 12:37:41 +02:00			`RestrictAddressFamilies=AF_UNIX AF_LOCAL AF_NETLINK`
			`MemoryDenyWriteExecute=true`
			`RestrictRealtime=true`
Update Systemd security settings 2024-03-26 20:32:10 +00:00			`RestrictNamespaces=yes`
			`RestrictRealtime=yes`
			`RestrictSUIDSGID=yes`
Apply additional systemd hardening options 2024-04-12 14:08:30 -05:00			`SystemCallFilter=@system-service`
			`SystemCallFilter=~@resources @privileged`
			`SystemCallErrorNumber=EPERM`
			`SystemCallArchitectures=native`
data: Tell service when and how to start 2020-09-09 13:00:13 +02:00
			`[Install]`
			`WantedBy=graphical.target`