[Unit]
Wants=network-online.target dbus.socket
After=network-online.target dbus.socket

[Service]
Type=notify
Restart=on-failure
DynamicUser=true

# Needed for walld to open tty devices
SupplementaryGroups=tty
ExecStart=/usr/bin/roowhod

ConfigurationDirectory=roowho2

# Finger needs CAP_DAC_READ_SEARCH to look for various files in user's home directories.
AmbientCapabilities=CAP_DAC_READ_SEARCH
CapabilityBoundingSet=CAP_DAC_READ_SEARCH
PrivateUsers=false
ProtectHome=false

# walld needs access to tty/pts devices.
DeviceAllow=char-tty rw
DeviceAllow=char-pts rw
PrivateDevices=false
DevicePolicy=closed

# Might use /proc/<pid>/stat to determine the caller's PID + UID
ProtectProc=default

LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateIPC=true
PrivateMounts=true
PrivateTmp=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=strict
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
RemoveIPC=true
RestrictAddressFamilies=AF_INET
RestrictAddressFamilies=AF_INET6
RestrictAddressFamilies=AF_UNIX
# Needed for auditd socket
RestrictAddressFamilies=AF_NETLINK
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SocketBindDeny=any
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged
SystemCallFilter=~@resources
UMask=0077