···

       
192
       
 
       
        serviceConfig.MemoryDenyWriteExecute = true;

     

       
193
       
 
       
        serviceConfig.NoNewPrivileges = true;

     

       
194
       
 
       
        serviceConfig.PrivateDevices = true;

     

       
195
       
-
       
        serviceConfig.ProtectClock = true;

     

       
196
       
 
       
        serviceConfig.ProtectControlGroups = true;

     

       
197
       
 
       
        serviceConfig.ProtectHome = true;

     

       
198
       
 
       
        serviceConfig.ProtectHostname = true;

     

···

       
192
       
 
       
        serviceConfig.MemoryDenyWriteExecute = true;

     

       
193
       
 
       
        serviceConfig.NoNewPrivileges = true;

     

       
194
       
 
       
        serviceConfig.PrivateDevices = true;

     

       
195
       
+
       
        serviceConfig.ProtectClock = mkDefault true;

     

       
196
       
 
       
        serviceConfig.ProtectControlGroups = true;

     

       
197
       
 
       
        serviceConfig.ProtectHome = true;

     

       
198
       
 
       
        serviceConfig.ProtectHostname = true;

     

···

       
37
       
 
       
      '';

     

       
38
       
 
       
      # The systemd collector needs AF_UNIX

     

       
39
       
 
       
      RestrictAddressFamilies = lib.optional (lib.any (x: x == "systemd") cfg.enabledCollectors) "AF_UNIX";

     

       
0
       
 
       

     

       
0
       
 
       

     

       
40
       
 
       
    };

     

       
41
       
 
       
  };

     

       
42
       
 
       
}

     

···

       
37
       
 
       
      '';

     

       
38
       
 
       
      # The systemd collector needs AF_UNIX

     

       
39
       
 
       
      RestrictAddressFamilies = lib.optional (lib.any (x: x == "systemd") cfg.enabledCollectors) "AF_UNIX";

     

       
40
       
+
       
      # The timex collector needs to access clock APIs

     

       
41
       
+
       
      ProtectClock = lib.any (x: x == "timex") cfg.disabledCollectors;

     

       
42
       
 
       
    };

     

       
43
       
 
       
  };

     

       
44
       
 
       
}