Issue
Description of problem:
The output of 'systemd-analyze security rsyslog.service' generates false output in some cases, see below.
Version-Release number of selected component (if applicable):
systemd-239-75.el8.x86_64
How reproducible:
always
Steps to Reproduce:
1. systemd-analyze security rsyslog.service
...
✗ SystemCallFilter=~@clock Service does not filter system calls 0.2
✗ SystemCallFilter=~@debug Service does not filter system calls 0.2
✗ SystemCallFilter=~@module Service does not filter system calls 0.2
✗ SystemCallFilter=~@mount Service does not filter system calls 0.2
✗ SystemCallFilter=~@raw-io Service does not filter system calls 0.2
✗ SystemCallFilter=~@reboot Service does not filter system calls 0.2
✗ SystemCallFilter=~@swap Service does not filter system calls 0.2
✗ SystemCallFilter=~@privileged Service does not filter system calls 0.2
✗ SystemCallFilter=~@resources Service does not filter system calls 0.2
...
3. After review, I added the following line to the rsyslog service file (/usr/lib/systemd/system/rsyslog.service):
SystemCallFilter=~@clock @debug @module @raw-io @reboot @swap @cpu-emulation @obsolete
4. systemctl daemon-reload && systemctl restart rsyslog
Actual results:
systemd-analyze still reports that the systemcallfilters are not present.
Expected results:
systemd-analyze should not report that the systemcallfilters are not present.
Additional info:
On rhel-9.3 with systemd-252-13.el9_2.x86_64, the problem can not be reproduced.
