systemd: protect /usr when running under systemd

2015-08-11 19:00:21 +02:00 · 2015-08-11 19:00:21 +02:00 · 5d13c13821
parent 21ef656e24
commit 5d13c13821
1 changed files with 3 additions and 0 deletions
--- a/systemd/mpd.service.in
+++ b/systemd/mpd.service.in
@ -19,6 +19,9 @@ ControlGroup=cpu:/mpd
 # assign a real-time budget
 ControlGroupAttribute=cpu.rt_runtime_us 500000

+# disallow writing to /usr, /bin, /sbin, ...
+ProtectSystem=yes
+
 [Install]
 WantedBy=multi-user.target
 Also=mpd.socket