2017-11-18 19:35:03 +03:00
# SPDX-License-Identifier: LGPL-2.1+
#
2014-05-16 22:14:23 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
2014-05-19 00:10:48 +04:00
[Unit]
Description = Network Name Resolution
Documentation = man:systemd-resolved.service(8)
2017-06-29 05:54:12 +03:00
Documentation = https://www.freedesktop.org/wiki/Software/systemd/resolved
Documentation = https://www.freedesktop.org/wiki/Software/systemd/writing-network-configuration-managers
Documentation = https://www.freedesktop.org/wiki/Software/systemd/writing-resolver-clients
2017-12-11 21:27:49 +03:00
DefaultDependencies = no
After = systemd-sysusers.service systemd-networkd.service
Before = network.target nss-lookup.target shutdown.target
Conflicts = shutdown.target
2017-04-21 12:21:17 +03:00
Wants = nss-lookup.target
2014-05-19 00:10:48 +04:00
[Service]
Type = notify
Restart = always
RestartSec = 0
2017-08-09 17:15:07 +03:00
ExecStart = !!@rootlibexecdir@/systemd-resolved
2016-08-26 14:23:27 +03:00
WatchdogSec = 3min
2017-08-09 17:15:07 +03:00
User = systemd-resolve
CapabilityBoundingSet = CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
AmbientCapabilities = CAP_SETPCAP CAP_NET_RAW CAP_NET_BIND_SERVICE
2016-08-26 14:23:27 +03:00
PrivateTmp = yes
PrivateDevices = yes
2017-02-09 12:58:28 +03:00
ProtectSystem = strict
2014-06-04 20:07:55 +04:00
ProtectHome = yes
2016-08-26 14:23:27 +03:00
ProtectControlGroups = yes
ProtectKernelTunables = yes
2017-02-09 13:09:50 +03:00
ProtectKernelModules = yes
2016-06-08 15:23:37 +03:00
MemoryDenyWriteExecute = yes
2016-08-26 14:23:27 +03:00
RestrictRealtime = yes
2018-05-10 18:17:38 +03:00
RestrictNamespaces = yes
2016-08-26 14:23:27 +03:00
RestrictAddressFamilies = AF_UNIX AF_NETLINK AF_INET AF_INET6
2017-02-09 13:22:08 +03:00
SystemCallFilter = ~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
2017-02-09 00:32:37 +03:00
SystemCallArchitectures = native
2017-09-14 20:45:40 +03:00
LockPersonality = yes
2017-08-09 17:15:07 +03:00
RuntimeDirectory = systemd/resolve
RuntimeDirectoryPreserve = yes
2014-05-19 00:10:48 +04:00
[Install]
WantedBy = multi-user.target
2017-02-16 19:48:48 +03:00
Alias = dbus-org.freedesktop.resolve1.service