2020-11-09 07:23:58 +03:00
# SPDX-License-Identifier: LGPL-2.1-or-later
2017-11-18 19:35:03 +03:00
#
2016-02-08 23:16:08 +03:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
Description = Process Core Dump
Documentation = man:systemd-coredump(8)
DefaultDependencies = no
Conflicts = shutdown.target
2020-04-08 17:24:23 +03:00
After = systemd-journald.socket
2016-02-08 23:16:08 +03:00
Requires = systemd-journald.socket
Before = shutdown.target
[Service]
2023-06-12 04:15:19 +03:00
ExecStart = -{{LIBEXECDIR}}/systemd-coredump
2018-11-12 19:19:48 +03:00
IPAddressDeny = any
LockPersonality = yes
MemoryDenyWriteExecute = yes
2016-02-08 23:16:08 +03:00
Nice = 9
2018-11-12 19:19:48 +03:00
NoNewPrivileges = yes
2016-02-08 23:16:08 +03:00
OOMScoreAdjust = 500
2017-02-09 13:17:45 +03:00
PrivateDevices = yes
2016-02-08 23:16:08 +03:00
PrivateNetwork = yes
2018-11-12 19:19:48 +03:00
PrivateTmp = yes
2017-02-09 13:17:45 +03:00
ProtectControlGroups = yes
2018-11-12 19:19:48 +03:00
ProtectHome = yes
2019-02-19 01:30:12 +03:00
ProtectHostname = yes
2017-02-09 13:17:45 +03:00
ProtectKernelModules = yes
2018-11-12 19:19:48 +03:00
ProtectKernelTunables = yes
2019-11-14 03:56:23 +03:00
ProtectKernelLogs = yes
2018-11-12 19:19:48 +03:00
ProtectSystem = strict
2017-02-09 13:17:45 +03:00
RestrictAddressFamilies = AF_UNIX
2018-11-12 19:19:48 +03:00
RestrictRealtime = yes
2019-03-20 21:52:20 +03:00
RestrictSUIDSGID = yes
2018-11-12 19:19:48 +03:00
RuntimeMaxSec = 5min
2017-08-02 11:35:11 +03:00
StateDirectory = systemd/coredump
2018-11-12 19:19:48 +03:00
SystemCallArchitectures = native
SystemCallErrorNumber = EPERM
2021-11-21 20:05:28 +03:00
SystemCallFilter = @system-service @mount