[Unit]
Description=Firmware update daemon
Documentation=https://fwupd.org/
After=dbus.service
Before=display-manager.service
ConditionVirtualization=!container

[Service]
Type=dbus
TimeoutSec=180
RuntimeDirectory=motd.d
RuntimeDirectoryPreserve=yes
BusName=org.freedesktop.fwupd
ExecStart=/usr/libexec/fwupd/fwupd
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=full
SystemCallFilter=~@mount
Environment="GLIBC_TUNABLES=glibc.cpu.hwcaps=SHSTK"
ProtectControlGroups=yes
ProtectKernelModules=yes
RestrictRealtime=yes
ReadWritePaths=-/boot/efi -/boot/EFI -/boot/grub -/efi/EFI -/sys/firmware/efi/efivars
ConfigurationDirectory=fwupd
StateDirectory=fwupd
CacheDirectory=fwupd
RestrictAddressFamilies=AF_NETLINK AF_UNIX AF_INET AF_INET6