aide-common.dailyaidecheck.service

[Unit]
Description=daily AIDE check
Documentation=file:/usr/share/doc/aide/README.Debian.gz
StartLimitIntervalSec=7200
StartLimitBurst=1

[Service]
Type=oneshot
User=_aide
Group=_aide
AmbientCapabilities=CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE
# we need those to see the "real" system
PrivateDevices=no
# We cannot use any of systemd's sandboxing features here since
# that would mask away a couple of /run subdirectories including
# /run/credentials
ExecStart=/usr/share/aide/bin/dailyaidecheck --systemdservice