1#@!#!123s

: / usr / lib / systemd / system /
Filename : polkit.service
back
[Unit]
Description=Authorization Manager
Documentation=man:polkit(8)

[Service]
Type=notify-reload
BusName=org.freedesktop.PolicyKit1
CapabilityBoundingSet=CAP_SETUID CAP_SETGID
DeviceAllow=/dev/null rw
DevicePolicy=strict
ExecStart=/usr/lib/polkit-1/polkitd --no-debug --log-level=notice
User=polkitd
LimitMEMLOCK=0
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateNetwork=yes
PrivateTmp=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectKernelTunables=yes
ProtectSystem=strict
ProtectClock=yes
ProtectHostname=yes
RemoveIPC=yes
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
SystemCallFilter=@system-service
UMask=0077

# Mitigate memory leaks
MemoryMax=32M
MemorySwapMax=32M
OOMPolicy=stop
Restart=on-failure