blob: 6c3251c9b718d15c779192e6463d130a58ceaa35 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
[Unit]
Description=Update prelinking
[Service]
Type=oneshot
ExecStart=/usr/bin/prelink --all --conserve-memory --random
## Various options for sandboxing the process/service
# See man:systemd.exec(5) for details
PrivateTmp=true
PrivateDevices=true
PrivateNetwork=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
RestrictRealtime=true
# In far most cases, prelink will only operate in /usr and maybe /opt
ProtectSystem=false
ProtectHome=true
|