[Unit]
|
Description=Hardware RNG Entropy Gatherer Daemon
|
DefaultDependencies=no
|
After=systemd-udev-settle.service
|
Before=sysinit.target shutdown.target
|
Wants=systemd-udev-settle.service
|
Conflicts=shutdown.target
|
|
[Service]
|
EnvironmentFile=-@SYSCONFDIR@/default/rng-tools
|
ExecStart=@SBINDIR@/rngd -f $EXTRA_ARGS
|
CapabilityBoundingSet=CAP_SYS_ADMIN
|
IPAddressDeny=any
|
LockPersonality=yes
|
MemoryDenyWriteExecute=yes
|
NoNewPrivileges=yes
|
PrivateTmp=yes
|
ProtectControlGroups=yes
|
ProtectHome=yes
|
ProtectHostname=yes
|
ProtectKernelModules=yes
|
ProtectKernelLogs=yes
|
ProtectSystem=strict
|
RestrictAddressFamilies=AF_UNIX
|
RestrictNamespaces=yes
|
RestrictRealtime=yes
|
RestrictSUIDSGID=yes
|
SystemCallArchitectures=native
|
SystemCallErrorNumber=EPERM
|
SystemCallFilter=@system-service
|
|
[Install]
|
WantedBy=sysinit.target
|
