[Unit]
Wants=network-online.target dbus.socket
After=network-online.target dbus.socket

[Service]
Type=notify
Restart=on-failure
DynamicUser=true

# Needed for walld to open tty devices
SupplementaryGroups=tty
ExecStart=/usr/bin/roowhod

ConfigurationDirectory=roowho2

Environment=DBUS_SYSTEM_BUS_ADDRESS=unix:path=/run/dbus/system_bus_socket

AmbientCapabilities=CAP_DAC_READ_SEARCH
CapabilityBoundingSet=CAP_DAC_READ_SEARCH

# walld needs access to tty/pts devices.
DeviceAllow=char-tty rw
DeviceAllow=char-pts rw
PrivateDevices=false

# Might use /proc/<pid>/stat to determine the caller's PID + UID
ProtectProc=default

DevicePolicy=closed
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateIPC=true
PrivateMounts=true
PrivateTmp=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=strict
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
RemoveIPC=true
RestrictAddressFamilies=AF_INET
RestrictAddressFamilies=AF_INET6
RestrictAddressFamilies=AF_UNIX
RestrictAddressFamilies=AF_NETLINK
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SocketBindDeny=any
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged
SystemCallFilter=~@resources
UMask=0077