1 # SPDX-License-Identifier: GPL-2.0
3 # Copyright (C) 2023-2024 Oracle. All Rights Reserved.
4 # Author: Darrick J. Wong <djwong@kernel.org>
7 Description=Online bcachefsck for All Filesystems Failure Reporting
8 Documentation=man:bcachefsck_all(8)
12 Environment=EMAIL_ADDR=root
13 ExecStart=@libexecdir@/bcachefsck_fail "${EMAIL_ADDR}" bcachefsck_all
16 SupplementaryGroups=systemd-journal
18 # No realtime scheduling
21 # Make the entire filesystem readonly and /home inaccessible.
27 # Emailing reports requires network access, but not the ability to change the
31 # Don't let the program mess with the kernel configuration at all
32 ProtectKernelLogs=true
33 ProtectKernelModules=true
34 ProtectKernelTunables=true
35 ProtectControlGroups=true
37 RestrictNamespaces=true
39 # Can't hide /proc because journalctl needs it to find various pieces of log
43 # Only allow the default personality Linux
46 # No writable memory pages
47 MemoryDenyWriteExecute=true
49 # Don't let our mounts leak out to the host
52 # Restrict system calls to the native arch and only enough to get things going
53 SystemCallArchitectures=native
54 SystemCallFilter=@system-service
55 SystemCallFilter=~@privileged
56 SystemCallFilter=~@resources
57 SystemCallFilter=~@mount
59 # xfs_scrub needs these privileges to run, and no others
60 CapabilityBoundingSet=
63 # Failure reporting shouldn't create world-readable files
66 # Clean up any IPC objects when this unit stops
69 # No access to hardware device files