[Unit]
Description=Firmware update daemon
Documentation=https://fwupd.org/
Wants=modprobe@sd_mod.service
After=modprobe@sd_mod.service dbus.service
Before=display-manager.service
ConditionVirtualization=!container

[Service]
Type=dbus
TimeoutSec=180
RuntimeDirectory=@motd_dir@
RuntimeDirectoryPreserve=yes
BusName=org.freedesktop.fwupd
ExecStart=@libexecdir@/fwupd/fwupd
KeyringMode=private
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=no
PrivateDevices=no
PrivateTmp=true
ProtectClock=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=full
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallArchitectures=native
Environment="GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK"
RestrictAddressFamilies=AF_NETLINK AF_UNIX AF_INET AF_INET6
@dynamic_options@
