[Unit]
Description=HAN local KESL scan broker
Requires=han-kesl-scan-broker.socket
After=kesl.service

[Service]
Type=simple
User=root
Group=han-message-safety
ExecStart=/usr/local/libexec/han-kesl-scan-broker
Environment=HAN_KESL_SCAN_TIMEOUT_SEC=60
Environment=HAN_KESL_SCAN_CONCURRENCY=5
StateDirectory=han-kesl-scan
StateDirectoryMode=0700
UMask=0077
NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
RestrictAddressFamilies=AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallArchitectures=native
ReadWritePaths=/var/lib/han-kesl-scan
CapabilityBoundingSet=
AmbientCapabilities=
LimitCORE=0
LimitNOFILE=128
TasksMax=64
MemoryMax=256M

[Install]
WantedBy=multi-user.target