diff options
Diffstat (limited to 'meta/recipes-support/rng-tools/rng-tools/rng-tools.service')
| -rw-r--r-- | meta/recipes-support/rng-tools/rng-tools/rng-tools.service | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/meta/recipes-support/rng-tools/rng-tools/rng-tools.service b/meta/recipes-support/rng-tools/rng-tools/rng-tools.service new file mode 100644 index 0000000000..5ae2fba215 --- /dev/null +++ b/meta/recipes-support/rng-tools/rng-tools/rng-tools.service | |||
| @@ -0,0 +1,32 @@ | |||
| 1 | [Unit] | ||
| 2 | Description=Hardware RNG Entropy Gatherer Daemon | ||
| 3 | DefaultDependencies=no | ||
| 4 | Conflicts=shutdown.target | ||
| 5 | Before=sysinit.target shutdown.target | ||
| 6 | ConditionVirtualization=!container | ||
| 7 | |||
| 8 | [Service] | ||
| 9 | EnvironmentFile=-@SYSCONFDIR@/default/rng-tools | ||
| 10 | ExecStart=@SBINDIR@/rngd -f $EXTRA_ARGS | ||
| 11 | CapabilityBoundingSet=CAP_SYS_ADMIN | ||
| 12 | IPAddressDeny=any | ||
| 13 | LockPersonality=yes | ||
| 14 | MemoryDenyWriteExecute=yes | ||
| 15 | NoNewPrivileges=yes | ||
| 16 | PrivateTmp=yes | ||
| 17 | ProtectControlGroups=yes | ||
| 18 | ProtectHome=yes | ||
| 19 | ProtectHostname=yes | ||
| 20 | ProtectKernelModules=yes | ||
| 21 | ProtectKernelLogs=yes | ||
| 22 | ProtectSystem=strict | ||
| 23 | RestrictAddressFamilies=AF_UNIX | ||
| 24 | RestrictNamespaces=yes | ||
| 25 | RestrictRealtime=yes | ||
| 26 | RestrictSUIDSGID=yes | ||
| 27 | SystemCallArchitectures=native | ||
| 28 | SystemCallErrorNumber=EPERM | ||
| 29 | SystemCallFilter=@system-service | ||
| 30 | |||
| 31 | [Install] | ||
| 32 | WantedBy=sysinit.target | ||