blob: 632669fb3365850693d79bbd55eb68059fbbc74d (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
[Unit]
Description=Lifeboat backup for %I
AssertPathExists=/srv/backup/lifeboat/%i
[Service]
User=lifeboat
Group=lifeboat
Type=oneshot
ExecStart=/usr/bin/lifeboat %i run-report
AmbientCapabilities=CAP_DAC_READ_SEARCH
CapabilityBoundingSet=CAP_DAC_READ_SEARCH
DevicePolicy=closed
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=read-only
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=strict
RemoveIPC=yes
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallFilter=@system-service
ReadWritePaths=/srv/backup/lifeboat
CPUSchedulingPolicy=batch
IOSchedulingClass=idle
IOSchedulingPriority=7
Nice=19
|
