name : apport-coredump-hook@.service # This service is responsible for reading the coredump data from systemd journal # after a crash has occurred, and generating a crash file to /var/crash/. [Service] Type=oneshot ExecStart=/usr/share/apport/apport --from-systemd-coredump %i Nice=9 OOMScoreAdjust=500 IPAddressDeny=any LockPersonality=yes MemoryDenyWriteExecute=yes NoNewPrivileges=yes PrivateDevices=yes PrivateNetwork=yes PrivateTmp=yes ProtectControlGroups=yes ProtectHome=read-only ProtectHostname=yes ProtectKernelLogs=yes ProtectKernelModules=yes ProtectKernelTunables=yes ProtectSystem=strict ReadWritePaths=/var/crash /var/log RestrictAddressFamilies=AF_UNIX RestrictRealtime=yes RestrictSUIDSGID=yes SystemCallArchitectures=native SystemCallErrorNumber=EPERM SystemCallFilter=@system-service @file-system @setuid