Improve php-fpm systemd unit file

- use PrivateTmp, now available everwhere, for better security
- add comment about how to customize the unit file

diff --git a/sapi/fpm/php-fpm.service.in b/sapi/fpm/php-fpm.service.in
index a2df30e28d59d922c0895a494f5e3e65b144db56..e2c807426b4c9658343fd63510a0e74644e8c6c9 100644 (file)
--- a/sapi/fpm/php-fpm.service.in
+++ b/sapi/fpm/php-fpm.service.in
@@ -1,3 +1,7 @@
+# It's not recommended to modify this file in-place, because it
+# will be overwritten during upgrades.  If you want to customize,
+# the best way is to use the "systemctl edit" command.
+
 [Unit]
 Description=The PHP FastCGI Process Manager
 After=syslog.target network.target
@@ -7,6 +11,7 @@ Type=@php_fpm_systemd@
 PIDFile=@localstatedir@/run/php-fpm.pid
 ExecStart=@sbindir@/php-fpm --nodaemonize --fpm-config @sysconfdir@/php-fpm.conf
 ExecReload=/bin/kill -USR2 $MAINPID
+PrivateTmp=true
 
 [Install]
 WantedBy=multi-user.target