From 3eb55a6e11efcaab94d6595bfbdbe8ab6557f662 Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Fri, 21 Sep 2018 12:33:21 +0200
Subject: [PATCH] Remove sandboxing that's unsupported in RHEL7's systemd
---
data/fprintd.service.in | 14 +-------------
1 file changed, 1 insertion(+), 13 deletions(-)
diff --git a/data/fprintd.service.in b/data/fprintd.service.in
index 5f46810..05f4ddf 100644
--- a/data/fprintd.service.in
+++ b/data/fprintd.service.in
@@ -8,10 +8,7 @@ BusName=net.reactivated.Fprint
ExecStart=@libexecdir@/fprintd
# Filesystem lockdown
-ProtectSystem=strict
-ProtectKernelTunables=true
-ProtectControlGroups=true
-ReadWritePaths=@localstatedir@/lib/fprint
+ProtectSystem=true
ProtectHome=true
PrivateTmp=true
@@ -19,14 +16,5 @@ PrivateTmp=true
PrivateNetwork=true
RestrictAddressFamilies=AF_UNIX AF_LOCAL AF_NETLINK
-# Execute Mappings
-MemoryDenyWriteExecute=true
-
-# Modules
-ProtectKernelModules=true
-
-# Real-time
-RestrictRealtime=true
-
# Privilege escalation
NoNewPrivileges=true
--
2.17.1