diff options
Diffstat (limited to 'dev-db/mysql-init-scripts/files/mysqld_at-v2.service')
| -rw-r--r-- | dev-db/mysql-init-scripts/files/mysqld_at-v2.service | 21 |
1 files changed, 19 insertions, 2 deletions
diff --git a/dev-db/mysql-init-scripts/files/mysqld_at-v2.service b/dev-db/mysql-init-scripts/files/mysqld_at-v2.service index 4c6a8caf46d7..770a2e8d4dde 100644 --- a/dev-db/mysql-init-scripts/files/mysqld_at-v2.service +++ b/dev-db/mysql-init-scripts/files/mysqld_at-v2.service @@ -16,11 +16,28 @@ ExecStartPost=/usr/libexec/mysqld-wait-ready $MAINPID # Give a reasonable amount of time for the server to start up/shut down TimeoutSec=300 -# We rely on systemd, not mysqld_safe, to restart mysqld if it dies -Restart=always +# Restart crashed server only, on-failure would also restart, for example, when +# my.cnf contains unknown option +Restart=on-abort +RestartSec=5s # Place temp files in a secure directory, not /tmp PrivateTmp=true +# To allow memlock to be used as non-root user if set in configuration +CapabilityBoundingSet=CAP_IPC_LOCK + +# Prevent writes to /usr, /boot, and /etc +ProtectSystem=full + +NoNewPrivileges=true + +PrivateDevices=true + +# Prevent accessing /home, /root and /run/user +ProtectHome=true + +UMask=007 + [Install] WantedBy=multi-user.target |