# SPDX-License-Identifier: GPL-2.0-or-later
#
# Copyright (C) 2026 Oracle.  All Rights Reserved.
# Author: Darrick J. Wong <djwong@kernel.org>
[Unit]
Description=service_ll Sample Fuse Service

# Don't leave failed units behind, systemd does not clean them up!
CollectMode=inactive-or-failed

[Service]
Type=exec
ExecStart=/path/to/service_ll

# Try to capture core dumps
LimitCORE=infinity

SyslogIdentifier=%N

# No realtime CPU scheduling
RestrictRealtime=true

# Don't let us see anything in the regular system, and don't run as root
DynamicUser=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
PrivateUsers=true

# No network access
PrivateNetwork=true
ProtectHostname=true
RestrictAddressFamilies=none
IPAddressDeny=any

# Don't let the program mess with the kernel configuration at all
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
ProtectProc=invisible
RestrictNamespaces=true
RestrictFileSystems=

# Hide everything in /proc, even /proc/mounts
ProcSubset=pid

# Only allow the default personality Linux
LockPersonality=true

# No writable memory pages
MemoryDenyWriteExecute=true

# Don't let our mounts leak out to the host
PrivateMounts=true

# Restrict system calls to the native arch and only enough to get things going
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallFilter=~@privileged
SystemCallFilter=~@resources

SystemCallFilter=~@clock
SystemCallFilter=~@cpu-emulation
SystemCallFilter=~@debug
SystemCallFilter=~@module
SystemCallFilter=~@reboot
SystemCallFilter=~@swap

SystemCallFilter=~@mount

# libfuse io_uring wants to pin cores and memory
SystemCallFilter=mbind
SystemCallFilter=sched_setaffinity

# Leave a breadcrumb if we get whacked by the system call filter
SystemCallErrorNumber=EL3RST

# Log to the kernel dmesg, just like an in-kernel filesystem driver
StandardOutput=append:/dev/ttyprintk
StandardError=append:/dev/ttyprintk

# Run with no capabilities at all
CapabilityBoundingSet=
AmbientCapabilities=
NoNewPrivileges=true

# We don't create files
UMask=7777

# No access to hardware /dev files at all
ProtectClock=true
DevicePolicy=closed

# Don't mess with set[ug]id anything.
RestrictSUIDSGID=true

# Don't let OOM kills of processes in this containment group kill the whole
# service, because we don't want filesystem drivers to go down.
OOMPolicy=continue
OOMScoreAdjust=-1000
