%files
%manifest net-config.manifest
%files
%manifest net-config.manifest
-%attr(755,root,root) %{_sbindir}/*
-%attr(644,network_fw,network_fw) %{_sysconfdir}/resolv.conf
+%attr(500,root,root) %{_sbindir}/*
+%attr(644,root,root) %{_sysconfdir}/resolv.conf
%attr(644,root,root) %{_datadir}/dbus-1/system-services/*
#DBus DAC
%attr(644,root,root) %{_sysconfdir}/dbus-1/system.d/*
%attr(644,root,root) %{_datadir}/dbus-1/system-services/*
#DBus DAC
%attr(644,root,root) %{_sysconfdir}/dbus-1/system.d/*
SmackProcessLabel=System
ExecStart=/usr/sbin/net-config
Restart=always
SmackProcessLabel=System
ExecStart=/usr/sbin/net-config
Restart=always
-User=network_fw
-Group=network_fw
+CapabilityBoundingSet=~CAP_MAC_ADMIN
+CapabilityBoundingSet=~CAP_MAC_OVERRIDE
[Install]
WantedBy=multi-user.target
[Install]
WantedBy=multi-user.target