99659e4cf9
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEA5IzWngIOJSkMBxDI26KWMbbRRIFAlhPxTwQHG1heEBtdXNp Y3BkLm9yZwAKCRAjbopYxttFEoR8EACnEBj1zPTiraIoDZi9ZyqvwHZWILdcHRID 8XdUWmgIAwbL83Fwzxfokl060TWa43DWTWtGvieWkMcaAaTYNf8wxH6KZFmEVPCe cvveFM6/PXJuEED16QjGoII9OzlIH330C4mmcmsfLPrcbAfULx7OtF7neIfbgpPX ZKgrO6HVbpsMH57+o1CnX6sZXHwW9EvUy0j4YRuSfGX/7pgItfBrypDqPJCv2Hy1 mDy6gKWr7psA5ZiwYfTWVU1SPBuJiaKEM2jU80A5XVN0eZOi1EtUeySpyQO8Uncu hnJApi9Pd6IT9Tb4Wz7LshmqHCjG82KC+EppI4ESrqE3R/OEsho1iPFej4SdJycV XIcIRJ/S2JeopgGo4k/vlVzf4Y/9CMZZ7nP4fG1/1yjIYFQbefJeo1Gp/8b5ZTRD 5PjFgNGFyClwXNsHesF/2wDlCs1/DTv51BnapVLKD6AO9uyAOrzxBSeg8qSuprXx K5m/z2dMdUNjBDzrSBzxKtVBwPfuARuo4Q633AxBk5C+HRpSdirtgrDBgE2aTDfU 4o+BjrhiL60t1C5iQJ48ahzCIRkEfe0czmfeNxu5Jiig8Y9cYtkYJezniyBIGkbL RpqPxnD0YFTzzvuP8dWP+3zarxelETDwnH8KxD5jLpy2Rf2qjoNbeJNd70N6e8nN z7Hnvp4YwQ== =qsCR -----END PGP SIGNATURE----- Merge tag 'v0.19.21' release v0.19.21
32 lines
826 B
SYSTEMD
32 lines
826 B
SYSTEMD
[Unit]
|
|
Description=Music Player Daemon
|
|
Documentation=man:mpd(1) man:mpd.conf(5)
|
|
After=network.target sound.target
|
|
|
|
[Service]
|
|
Type=notify
|
|
ExecStart=@prefix@/bin/mpd --no-daemon
|
|
|
|
# allow MPD to use real-time priority 50
|
|
LimitRTPRIO=50
|
|
LimitRTTIME=infinity
|
|
|
|
# disallow writing to /usr, /bin, /sbin, ...
|
|
ProtectSystem=yes
|
|
|
|
# more paranoid security settings
|
|
NoNewPrivileges=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectControlGroups=yes
|
|
# AF_NETLINK is required by libsmbclient, or it will exit() .. *sigh*
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
|
|
RestrictNamespaces=yes
|
|
|
|
# Note that "ProtectKernelModules=yes" is missing in the user unit
|
|
# because systemd 232 is unable to reduce its own capabilities
|
|
# ("Failed at step CAPABILITIES spawning /usr/bin/mpd: Operation not
|
|
# permitted")
|
|
|
|
[Install]
|
|
WantedBy=default.target
|