[Unit]
Description=Thunderbolt system service
After=polkit.service
Documentation=man:boltd(8)

[Service]
Type=dbus
BusName=org.freedesktop.bolt
ExecStart=@libexecdir@/boltd
#Environment="G_MESSAGES_DEBUG=all"
Restart=on-failure
NotifyAccess=main
WatchdogSec=3min

MemoryDenyWriteExecute=yes
PrivateTmp=yes
ProtectControlGroups=yes
ProtectHome=yes
ProtectKernelModules=yes
ProtectSystem=full
RestrictAddressFamilies=AF_NETLINK AF_UNIX
RestrictRealtime=yes
ReadWritePaths=@dbdir@
SystemCallFilter=~@mount
CapabilityBoundingSet=CAP_NET_ADMIN

#directory management
RuntimeDirectory=@dbname@
RuntimeDirectoryPreserve=yes
StateDirectory=@dbname@