MINOR: systemd: Add SystemD's SystemCallFilter option to the unit file
This option takes away system calls that are unneeded for haproxy's
operation and thus is a good defense in depth measure.
diff --git a/contrib/systemd/haproxy.service.in b/contrib/systemd/haproxy.service.in
index 846bcc7..7a8b6be 100644
--- a/contrib/systemd/haproxy.service.in
+++ b/contrib/systemd/haproxy.service.in
@@ -27,6 +27,8 @@
# ProtectKernelTunables=true
# ProtectKernelModules=true
# ProtectControlGroups=true
+# If your SystemD version supports them, you can add: @reboot, @swap, @sync
+# SystemCallFilter=~@cpu-emulation @keyring @module @obsolete @raw-io
[Install]
WantedBy=multi-user.target