37 lines
702 B
INI
37 lines
702 B
INI
[Unit]
|
|
Description=Bluetooth service
|
|
Documentation=man:bluetoothd(8)
|
|
ConditionPathIsDirectory=/sys/class/bluetooth
|
|
|
|
[Service]
|
|
Type=dbus
|
|
BusName=org.bluez
|
|
ExecStart=/usr/lib/bluetooth/bluetoothd
|
|
NotifyAccess=main
|
|
#WatchdogSec=10
|
|
Restart=on-failure
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
|
LimitNPROC=1
|
|
|
|
# Filesystem lockdown
|
|
ProtectHome=true
|
|
ProtectSystem=full
|
|
PrivateTmp=true
|
|
ProtectKernelTunables=true
|
|
ProtectControlGroups=true
|
|
ReadWritePaths=/var/lib/bluetooth
|
|
ReadOnlyPaths=/etc/bluetooth
|
|
|
|
# Execute Mappings
|
|
MemoryDenyWriteExecute=true
|
|
|
|
# Privilege escalation
|
|
NoNewPrivileges=true
|
|
|
|
# Real-time
|
|
RestrictRealtime=true
|
|
|
|
[Install]
|
|
WantedBy=bluetooth.target
|
|
Alias=dbus-org.bluez.service
|