mirror of
https://gitlab.com/mishakmak/pam-fprint-grosshack.git
synced 2026-04-09 04:13:33 +02:00
36d3d9d749
Give read-write access to USB devices in /dev, and the location of the fingerprints, access to Unix sockets for D-Bus and close everything else down. See systemd.exec(5) for details about the options.
29 lines
488 B
SYSTEMD
29 lines
488 B
SYSTEMD
[Unit]
|
|
Description=Fingerprint Authentication Daemon
|
|
Documentation=man:fprintd(1)
|
|
|
|
[Service]
|
|
Type=dbus
|
|
BusName=net.reactivated.Fprint
|
|
ExecStart=@libexecdir@/fprintd
|
|
|
|
# Filesystem lockdown
|
|
ProtectSystem=strict
|
|
ProtectKernelTunables=true
|
|
ProtectControlGroups=true
|
|
ReadWritePaths=@localstatedir@/lib/fprint
|
|
ProtectHome=true
|
|
PrivateTmp=true
|
|
|
|
# Network
|
|
PrivateNetwork=true
|
|
|
|
# Execute Mappings
|
|
MemoryDenyWriteExecute=true
|
|
|
|
# Modules
|
|
ProtectKernelModules=true
|
|
|
|
# Real-time
|
|
RestrictRealtime=true
|