blob: 5cd36f9bb142849f4215626ecd19c9e7751b65b2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
[Unit]
Description=OCIS daemon
After=syslog.target network.target
[Service]
User=ocis
Group=ocis
Type=simple
Environment=OCIS_BASE_DATA_PATH=/var/lib/ocis
Environment=OCIS_CONFIG_DIR=/etc/ocis
EnvironmentFile=/etc/ocis.env
ExecStart=/usr/bin/ocis server
WorkingDirectory=/var/lib/ocis
# Sandboxing
ProtectProc=invisible
ProtectSystem=strict
ReadWritePaths=/var/lib/ocis
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
PrivateIPC=yes
PrivateUsers=yes
ProtectHostname=yes
ProtectClock=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
RestrictNamespaces=yes
LockPersonality=yes
RestrictSUIDSGID=yes
RemoveIPC=yes
NoNewPrivileges=yes
SystemCallArchitectures=native
TimeoutStopSec=120
Restart=on-failure
[Install]
WantedBy=multi-user.target
|