systemd: protect /usr when running under systemd

5d13c138 · Florian Schlichting · Max Kellermann · 21ef656e · 5d13c138
Commit 5d13c138 authored Aug 11, 2015 by Florian Schlichting Committed by Max Kellermann Aug 11, 2015
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 0 deletions

mpd.service.in systemd/mpd.service.in +3 -0

No files found.
--- a/systemd/mpd.service.in
+++ b/systemd/mpd.service.in
@@ -19,6 +19,9 @@ ControlGroup=cpu:/mpd
 # assign a real-time budget
 ControlGroupAttribute=cpu.rt_runtime_us 500000

+# disallow writing to /usr, /bin, /sbin, ...
+ProtectSystem=yes
+
 [Install]
 WantedBy=multi-user.target
 Also=mpd.socket