관리-도구

편집 파일: fwupd.service

[Unit] Description=Firmware update daemon Documentation=https://fwupd.org/ Wants=modprobe@sd_mod.service After=modprobe@sd_mod.service dbus.service Before=display-manager.service ConditionVirtualization=!container [Service] Type=dbus TimeoutSec=180 RuntimeDirectory=motd.d RuntimeDirectoryPreserve=yes BusName=org.freedesktop.fwupd ExecStart=/usr/libexec/fwupd/fwupd KeyringMode=private LockPersonality=yes MemoryDenyWriteExecute=yes NoNewPrivileges=no PrivateDevices=no PrivateTmp=true ProtectClock=yes ProtectControlGroups=yes ProtectHome=yes ProtectHostname=yes ProtectKernelLogs=yes ProtectKernelModules=yes ProtectKernelTunables=yes ProtectProc=invisible ProtectSystem=full RestrictNamespaces=yes RestrictRealtime=yes RestrictSUIDSGID=yes SystemCallArchitectures=native Environment="GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK" RestrictAddressFamilies=AF_NETLINK AF_UNIX AF_INET AF_INET6 ReadWritePaths=-/boot/efi -/boot/EFI -/boot/grub -/efi/EFI -/sys/firmware/efi/efivars ConfigurationDirectory=fwupd StateDirectory=fwupd CacheDirectory=fwupd DeviceAllow=block-sd rw DeviceAllow=char-aux rw DeviceAllow=char-cpu/* rw DeviceAllow=char-drm rw DeviceAllow=char-gpiochip rw DeviceAllow=char-hidraw rw DeviceAllow=char-mei rw DeviceAllow=char-mtd rw DeviceAllow=char-tpm rw DeviceAllow=char-usb rw DeviceAllow=char-usb_device rw DeviceAllow=char-mem rw DeviceAllow=char-nvme rw DeviceAllow=block-blkext rw SystemCallFilter=@basic-io @file-system @io-event @ipc @network-io @process @sync @signal @timer @chown ioctl uname fadvise64 sysinfo madvise mremap splice vmsplice copy_file_range @raw-io Environment="FWUPD_SYSCALL_FILTER=systemd" SystemCallErrorNumber=EPERM