imaginary/trunk/imaginary.service

   1 [Service]
   2 ExecStart=/usr/bin/imaginary -a localhost
   3
   4 DynamicUser=true
   5
   6 NoNewPrivileges=true
   7 ProtectSystem=full
   8 ProtectKernelModules=true
   9 ProtectKernelTunables=true
  10 PrivateTmp=true
  11 LockPersonality=true
  12 ProtectHostname=true
  13 ProtectHome=true
  14 ProtectControlGroups=true
  15 ProtectKernelLogs=true
  16 PrivateDevices=true
  17 RestrictRealtime=true
  18 CapabilityBoundingSet=
  19 MemoryDenyWriteExecute=true
  20 CapabilityBoundingSet=CAP_NET_RAW
  21 AmbientCapabilities=CAP_NET_RAW
  22
  23 [Install]
  24 WantedBy=default.target